This vulnerability in Xuxueli xxl-job up to version 3.5.0 allows remote attackers to perform cross-site scripting attacks via crafted input in the name or author parameters of the /jobinfo/insert endpoint. The vulnerability arises from insufficient input sanitization or output encoding, enabling injection of malicious scripts. Public exploit code exists, but no vendor response or patch has been provided as of the publication date.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and low privileges (PR:L) but can be triggered remotely without authentication. No evidence of active exploitation in the wild is reported.

No official patch or vendor advisory is available. Users should apply input validation and output encoding controls on the affected parameters as a temporary mitigation. Monitor for updates from the vendor for an official fix. Consider restricting access to the /jobinfo/insert endpoint if feasible until a patch is available.