A stored XSS vulnerability in WeGIA versions prior to 3.6.10 exposes the application to malicious script injection, potentially leading to unauthorized actions or session compromise.

The application fails to properly sanitize user input within the Member Name (Nome Sócio) field. This allows an unauthenticated attacker to inject a script that is persistently stored in the database and executed when a user visits the affected URL.

The successful exploitation of this vulnerability allows for the execution of arbitrary scripts in the context of an unsuspecting user's session. This could lead to account takeover, unauthorized data modification, or the theft of sensitive institutional information. Given the CVSS score of 7.5, this represents a high-risk security flaw that necessitates immediate attention to maintain the integrity of charitable organization records.

Immediate Action: Upgrade the WeGIA installation to version 3.6.10 or later to ensure the input sanitization fix is applied.

Proactive Monitoring: Review application access and audit logs for suspicious activity or unexpected script execution patterns originating from the Member Registration module.

Compensating Controls: Implement a strict Content Security Policy (CSP) and utilize a Web Application Firewall (WAF) configured to filter common XSS payloads from input fields.

Public Exploit Available: Unknown.

The presence of this stored XSS vulnerability poses a significant risk to the security and privacy of the users of the WeGIA platform. Administrators must prioritize updating to version 3.6.10 immediately to eliminate this injection vector. Failure to patch allows persistent threats to remain active within the application database, potentially compromising organizational data integrity.