CVE-2025-41350 is a stored Cross-site Scripting (XSS) vulnerability in WinPlus version 24.11.27 by Informática del Este. The flaw arises from improper validation of user input in the 'descripcion' parameter of the '/WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post' endpoint. An authenticated remote attacker could exploit this by sending a crafted POST request, potentially causing malicious scripts to be stored and executed in the context of other users, leading to theft of session cookies.