This vulnerability arises because the frontend uses escapeHTML() to sanitize the username before embedding it into the onclick attribute, but browsers decode HTML entities in attribute values before parsing JavaScript. An attacker can include an encoded single quote (') in the username to break out of the JavaScript string literal, enabling arbitrary script injection. This stored XSS affects maalfer Pentestify versions prior to 1.1.1 and requires the attacker to be authenticated. The vulnerability allows execution of arbitrary JavaScript in the context of another authenticated user's browser upon interaction with the affected UI element.

An authenticated attacker can execute arbitrary JavaScript in the browser of another authenticated user, potentially leading to session hijacking, unauthorized actions, or data theft within the context of the vulnerable application. The impact is limited to users who interact with the maliciously crafted username entry by clicking the delete button.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 1.1.1 or later once available. Until then, restrict access to trusted users and avoid clicking suspicious account deletion buttons. Monitor vendor communications for official fixes or temporary mitigations.