CVE-2026-40353 is a stored cross-site scripting vulnerability in the wger open-source workout and fitness manager. In versions before 2.5, the attribution_link property in AbstractLicenseModel constructs HTML by directly embedding user-controlled license fields such as license_author without escaping. The resulting HTML is rendered with Django's |safe filter, allowing an authenticated user to inject JavaScript code via the license_author field of an ingredient. This malicious script executes in the context of any visitor viewing the affected ingredient page. The vulnerability is addressed in wger version 2.5.

Successful exploitation allows an authenticated user to inject and execute arbitrary JavaScript in the browsers of users viewing the compromised ingredient page. This can lead to session hijacking, defacement, or other client-side attacks depending on the injected payload. The CVSS 4.0 base score is 5.1, indicating a medium severity impact. There are no known exploits in the wild at this time.

This vulnerability is fixed in wger version 2.5. Users should upgrade to version 2.5 or later to remediate this issue. Since no official patch or temporary fix details are provided beyond the version update, upgrading is the recommended remediation. No additional vendor advisory content is available to indicate alternative mitigations or that no action is required.