Nagios XI versions prior to 2024R1.1.3 contain a cross-site scripting (XSS) vulnerability in the Capacity Planning Report component. This flaw arises from insufficient validation or escaping of user-supplied input, which could allow attackers to inject and execute arbitrary scripts in the context of a victim's browser. The vulnerability has a medium severity rating with a CVSS score of 5.4.