WinPlus v24.11.27 contains a stored Cross-site Scripting (XSS) vulnerability due to improper validation of user input in the 'descripcion' parameter of the '/WinplusPortal/ws/sWinplus.svc/json/savesolpla_post' endpoint. This flaw allows an authenticated remote attacker to inject malicious scripts that could execute in the context of other users, potentially leading to session cookie theft.