CVE-2026-102393: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Brainstorm Force Starter Templates

This vulnerability in Brainstorm Force Starter Templates (astra-sites) is due to improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). It affects all versions from initial release up to, but not including, version 4.7.8. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed, with impacts on confidentiality, integrity, and availability rated as low to high. No known exploits in the wild have been reported. The vulnerability allows malicious scripts to be stored and executed in the context of the affected web application.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected application, potentially allowing attackers to steal sensitive information, manipulate content, or disrupt availability. The scope of impact includes confidentiality, integrity, and availability with varying degrees of impact as per the CVSS vector. However, exploitation requires user interaction and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible.