CVE-2026-63171: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Omnispace Agora Project

Omnispace Agora Project before version 26.10.0 contains a stored XSS vulnerability that arises from improper neutralization of input during web page generation. Authenticated users can submit a forum category description with a crafted double-quote character that escapes the HTML input value attribute context. The vulnerability exploits the HTMLPurifier configuration that preserves double-quotes, allowing arbitrary script execution in the browser of users who view the forum category.

This vulnerability allows authenticated attackers to execute arbitrary scripts in the browsers of users who view the affected forum category. This can lead to session hijacking, defacement, or other malicious actions performed in the context of the victim's browser session. The CVSS 4.0 base score is 5.1, indicating a medium severity impact with network attack vector, low attack complexity, and no privileges required beyond authentication.

No explicit patch or remediation is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges to trusted users only and consider sanitizing or filtering input to prevent injection of double-quote characters in forum category descriptions.