This vulnerability is a stored XSS in StockAgile's server-side REST endpoint '/inventory/configuration/pricing-tiers'. It allows a remote authenticated attacker to inject malicious JavaScript code through text parameters like 'code' and 'name'. The injected scripts are stored and later displayed without proper sanitization or validation on the web management panel, enabling script execution in the context of authenticated users. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, and limited privileges required.

An authenticated attacker can inject persistent malicious scripts that execute in the browsers of other authenticated users accessing the management panel. This can lead to unauthorized actions performed with the victim's privileges, session hijacking, or other client-side impacts. There is no indication of direct system compromise or data exfiltration from the server itself based on the provided data.

No patch or official fix information is provided in the vendor advisory or source data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoint to trusted users only and consider implementing input validation or filtering on the client side as a temporary measure.