CVE-2026-19110 is a cross-site scripting vulnerability in DataGear versions up to 5.0.0. The flaw is located in the HtmlTplDashboardWidgetHtmlRenderer function within the Chart Name Handler component, where manipulation of the Title argument can lead to script injection. The vulnerability can be exploited remotely and has been publicly disclosed. The vendor was contacted but did not provide a response or remediation. The CVSS 3.1 score is 2.4, indicating low severity with attack vector network, low complexity, requiring high privileges and user interaction, and impacts integrity only without affecting confidentiality or availability.

The vulnerability allows remote attackers with high privileges and requiring user interaction to perform cross-site scripting attacks by manipulating the Title argument in the affected function. This can lead to limited integrity impact such as script injection but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

No official patch or remediation is currently available, and the vendor has not responded to the disclosure. Users should monitor vendor communications for updates. Until a fix is provided, limit exposure by restricting access to trusted users with high privileges and exercising caution with user-supplied input in the affected component.