# CVE-2025-41350: Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an…

Source: https://junglewise.ai/threats/cve-2025-41350-stored-cross-site-scripting-xss-vylnerability-type-in-winplus-v24  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-41350 · Severity: medium · CVSS 5.4 · Published 2025-11-18

Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

Technologies: [Iest Winplus](https://junglewise.ai/threats/technologies/winplus). Vendors: [Iest](https://junglewise.ai/threats/vendors/iest).

## Quick answers

**Is CVE-2025-41350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-41350 being exploited in the wild.

**How severe is CVE-2025-41350?** Medium severity, with a CVSS score of 5.4, published 18 November 2025.

**Which products and versions are affected?** Iest Winplus. The advisory does not name versions.

**Is there a fix for CVE-2025-41350?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-41350?** Check whether you run Iest Winplus. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Iest Winplus

## Related threats

- [Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an…](https://junglewise.ai/threats/cve-2025-41349-stored-cross-site-scripting-xss-vylnerability-type-in-winplus-v24)
- [SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker…](https://junglewise.ai/threats/cve-2025-41348-sql-injection-vulnerability-in-winplus-v24-11-27-by-informatica)
- [Unlimited upload vulnerability for dangerous file types in WinPlus v24.11.27 from Informática del Este. This…](https://junglewise.ai/threats/cve-2025-41347-unlimited-upload-vulnerability-for-dangerous-file-types-in)
- [Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be…](https://junglewise.ai/threats/cve-2025-41346-faulty-authorization-control-in-software-winplus-v24-11-27-by)