CVE-2025-26972 is a cross-site scripting vulnerability in NotFound PrivateContent (<= 8.11.5) caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that execute in the context of a victim's browser when they interact with crafted content. The CVSS 3.1 score of 7.1 reflects a high severity with network attack vector, low complexity, no privileges required, but requiring user interaction. The vulnerability affects confidentiality, integrity, and availability at a low level. No official patch or remediation guidance is currently available from the vendor, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS vector indicates limited impact on confidentiality, integrity, and availability, but the vulnerability is considered high severity due to ease of exploitation and potential user impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider implementing web application firewalls or input validation as temporary mitigations. Monitor official NotFound advisories for updates and patches.