This stored XSS in a purchasing portal carries more risk than its CVSS 5.4 suggests—because the victims are authenticated users with procurement authority, not random visitors. A payload executing in the context of someone who can approve purchase orders, modify supplier records, or authorize payments transforms a medium-severity XSS into a credential-harvesting and session-hijacking vector with direct financial implications. The CVSS framework treats all XSS as browser execution problems, not workflow-compromise problems, and that vocabulary gap is exactly why this class of bug gets under-prioritized in business software.
The deeper failure is architectural. This vulnerability sits at the boundary where external supplier data—product catalogs, RFQ submissions, invoice uploads—crosses into a system labeled "internal." That labeling is the vulnerability smell. Developers applied less rigorous security standards to this portal than they would to a public-facing form, because "only our suppliers use this system." But supplier data is adversarial data. The moment external parties submit content that gets stored and rendered back to authenticated users, you have a public-facing attack surface labeled as internal, and that's where these vulnerabilities crystallize consistently across business software stacks.
For defenders: audit any business portal that ingests external data for stored XSS, regardless of its "internal" classification. Treat supplier-facing forms, catalog imports, and RFQ uploads as high-risk input paths. Verify that output encoding is applied at the template layer, not just at input validation. The presence or absence of CSP headers is a diagnostic signal—if they're missing, the codebase likely developed in a security-review-free zone. The fix quality matters: a one-line output encoding patch treats the symptom; CSP deployment plus template refactoring suggests the underlying failure class was understood. Prioritize remediation based on the session privileges of users who access the affected portal, not the generic severity score.