Windu CMS has a stored cross-site scripting (XSS) vulnerability in its logon page due to improper input validation. An attacker can inject malicious HTML and JavaScript that executes when an admin visits the logs page. Version 4.1 is confirmed vulnerable; other versions have not been tested but may also be affected. No vendor response or patch information is available.