CVE-2026-12202 is a medium severity cross-site scripting vulnerability affecting Intelliants Subrion CMS up to version 4.0.3. The issue arises from improper handling of the CSS class name argument in the Blocks Endpoint component, allowing remote attackers to inject malicious scripts. Exploitation requires user interaction and high privileges, and no vendor response or patch has been provided as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, exploitation requires user interaction and high privileges, which limits the scope of impact. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider applying workarounds such as input validation or disabling the vulnerable component if feasible until a patch is released.