SVXportal versions 2.5 and prior suffer from a stored cross-site scripting vulnerability (CWE-79) in the user registration process. Specifically, user-supplied fields (Firstname, Lastname, Email) are stored in the backend database without adequate output encoding. These fields are subsequently displayed in the administrator interface (admin/users.php), enabling an unauthenticated remote attacker to inject and execute arbitrary JavaScript code in the context of an administrator's browser upon viewing the affected page. This vulnerability could lead to unauthorized script execution but requires the administrator to view the malicious content.

An unauthenticated remote attacker can inject malicious JavaScript into user registration fields, which is stored and later executed in the administrator's browser interface. This can lead to potential session hijacking, unauthorized actions performed by the administrator, or other script-based attacks. The impact is limited to the administrator's browser context and requires the administrator to access the affected page. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should exercise caution when viewing user registration data and consider implementing manual input validation or output encoding as a temporary mitigation. Monitoring for updates from the vendor is recommended.