CVE-2026-40286

CVE-2026-40286 is a Stored Cross-Site Scripting (XSS) vulnerability affecting WeGIA, a web management platform for charitable institutions, in versions prior to 3.6.10. An attacker can inject malicious scripts into the Member Name field during member registration, which are persistently stored in the database and executed whenever users access affected areas of the application. The vulnerability has been patched in version 3.6.10. The vulnerability presents high severity with a CVSS score of 7.5, exploitable over the network without requiring authentication or user interaction. The attack vector is straightforward, with low complexity, resulting in high integrity impact through potential unauthorized script execution and data manipulation. However, the attack does not enable data exfiltration or service disruption. Current exploitation status indicates minimal real-world activity, with an extremely low EPSS score of 0.0004 and no presence on the CISA Known Exploited Vulnerabilities (KEV) catalog. No active exploit code is documented in publicly available sources, and the vulnerability remains on the inactive portion of threat tracking lists. Organizations using WeGIA should prioritize updating to version 3.6.10, though the immediate threat level appears low.