A Cross-Site Scripting (XSS) vulnerability exists in the web backend of the Repetico app version 1.9.7.31 for Android. This flaw allows a remote authenticated user to inject and execute arbitrary JavaScript code within the app's context by submitting crafted input in the multiple-choice question text field. The vulnerability has a medium severity rating with a CVSS score of 5.4.