Webkul Aureus ERP versions up to 1.6.0 contain a stored cross-site scripting vulnerability in the Payment Term note field. This field is saved without proper input neutralization and rendered as raw HTML in the Accounting plugin. Authenticated users with payment-term create permissions can submit malicious JavaScript code to the payment-terms endpoint. This code is persisted in the database and executed in the context of any user viewing the affected Payment Term record, potentially leading to script execution in their browsers.

An attacker with authenticated access and payment-term create permissions can inject malicious JavaScript that executes in the browsers of other users viewing the affected payment term. This may lead to session hijacking, unauthorized actions, or other client-side impacts depending on the injected script. The vulnerability requires authentication and specific permissions, limiting exposure to authorized users only.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict payment-term create permissions to trusted users only and consider implementing input sanitization or filtering at the application or web server level to mitigate risk.