A stored cross-site scripting (XSS) vulnerability exists in Tenda AC18 firmware version 15.03.05.05_multi. The flaw is in the ssid parameter of the wireless settings, allowing remote attackers with limited privileges to inject malicious scripts that execute when users visit the router's homepage.