[SECURITY]: Stored XSS Leading to Admin Account Compromise

[titaniumtushar]

Description

Vulnerability Type: Stored Cross-Site Scripting (Stored XSS)

Reported By: Tushar Daga
Company: Astra IT Inc

I HAVE EMAILED YOU THE DETAILS ON info@worklenz.com
Please Review it as soon as possible, I reported it a week ago.
Thankyou

Steps to Reproduce

No response

Potential Impact

This is a high-severity stored XSS vulnerability with the following potential impact:

• Theft of administrator session cookies
• Account takeover of privileged users
• Execution of arbitrary actions on behalf of the admin
• Persistent backdoor via stored JavaScript payloads
• Exposure of sensitive application data
• Because the payload executes without any user interaction, exploitation is highly reliable and stealthy.