The vulnerability CVE-2026-15492 in igweze wizgrade involves a cross-site scripting (XSS) flaw in the dashboard/studentConductManager.php file. This allows remote attackers to inject malicious scripts that could be executed in the context of a victim's browser. The product uses a rolling release system, and the affected version is identified by commit b1d55f22b90cd7e7a6e5002f006d7c649e8086d6. The vendor did not respond to early contact regarding this issue, and no official remediation or patch has been published. The CVSS 4.0 score is 5.3, indicating medium severity with no privileges required, low attack complexity, and user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of a user's browser, potentially leading to session hijacking, defacement, or other malicious actions that rely on script execution. However, the impact is limited by the requirement for user interaction and the absence of privileges or authentication requirements. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. In the meantime, applying web application firewalls or input validation controls may help mitigate exploitation risks.