The vulnerability is a stored XSS (CWE-79) in maalfer Pentestify's user management component prior to version 1.1.1. The frontend uses escapeHTML() to sanitize the username before inserting it into the onclick attribute of the account deletion button. However, because browsers decode HTML attribute values before parsing JavaScript, an encoded single quote can break out of the string literal, enabling an attacker to inject and execute arbitrary JavaScript code in the context of another authenticated user's browser. This requires the attacker to be authenticated and the victim to interact with the maliciously crafted username entry.

An authenticated attacker can execute arbitrary JavaScript in the browsers of other authenticated users, potentially leading to session hijacking, unauthorized actions, or data theft within the application context. The attack requires user interaction (clicking the delete button) and authentication, limiting the scope but still posing a moderate risk.

No official patch or fix is currently confirmed. Users should upgrade to maalfer Pentestify version 1.1.1 or later once available. Until then, apply strict input validation and output encoding on usernames, especially when used in HTML attributes. Avoid embedding user input directly in JavaScript event handlers. Monitor vendor advisories for updates on official remediation.