CVE-2026-12202 is a cross-site scripting vulnerability affecting Intelliants Subrion CMS up to version 4.0.3. The vulnerability is located in an unspecified functionality of the Blocks Endpoint component, where manipulation of the CSS class name argument enables injection of malicious scripts. This flaw can be exploited remotely without user interaction but requires high privileges. The vulnerability was publicly disclosed, and no official remediation or patch has been provided by the vendor as of the publication date.

Successful exploitation allows an attacker with high privileges to inject and execute arbitrary scripts in the context of the affected CMS, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires no user interaction but does require high privileges, limiting the scope of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider applying workarounds such as input validation or filtering on the CSS class name parameter if possible, or restricting access to the Blocks Endpoint. Monitor official channels for updates or patches from Intelliants.