bizwell xClick EUVD-2026-78254

Exploitation requires an authenticated account with at least low-privilege access to xClick (PR:L per CVSS 4.0 vector) - an unauthenticated external attacker cannot directly inject payloads. A second prerequisite is passive victim interaction (UI:P): another authenticated user must view the page or content containing the stored payload for the script to execute. The vulnerability is limited to xClick releases R2, R3, and R3.1; deployments on other versions are not confirmed affected. The product must be network-accessible to the attacker for initial payload submission (AV:N). There is no indication this requires any special non-default configuration beyond basic groupware use.

The CVSS 4.0 score of 5.1 (Medium) aligns reasonably with the actual risk profile. PR:L confirms an authenticated attacker is required - an unauthenticated outsider cannot directly inject payloads, which substantially reduces exposure. UI:P means a second user must view the stored content, adding a social or workflow dependency. The confidentiality impact is limited to VC:L (e.g., session token exfiltration within the same application context), and VI:N in the vendor's vector suggests no direct integrity write was assessed, though stored XSS classically carries at least minor integrity implications in the victim's browser. No EPSS score, KEV listing, or POC code is available in the supplied intelligence, so there is no signal of active or imminent exploitation. The product is a niche regional groupware solution, further constraining real-world attack surface. This is a genuine but low-urgency remediation priority for affected deployments.

An authenticated xClick user with a low-privilege account (e.g., a standard groupware member) submits a message, document field, or profile entry containing a malicious JavaScript payload. When a colleague or administrator views that content in their browser session, the script executes in their authentication context, potentially exfiltrating their session token or performing actions on their behalf. No public exploit code is available at time of analysis, so exploitation would require manual crafting of a stored XSS payload.