This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Repetico web backend. An authenticated remote attacker can inject malicious JavaScript code through the multiple-choice question text field, leading to cross-site scripting within the app's context. The vulnerability affects versions up to 2026-06-30. No known exploits are reported in the wild, and no vendor patch or advisory is currently provided.

Successful exploitation allows an authenticated user to execute arbitrary JavaScript code in the context of the Repetico app, potentially leading to information disclosure or manipulation of the app's interface. The impact is limited to confidentiality and integrity with no reported availability impact. The vulnerability requires user interaction and authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and avoid entering untrusted input in the multiple-choice question text field. Monitor vendor communications for updates on official patches or mitigations.