CVE-2026-14704 is a cross-site scripting vulnerability affecting stephen-kruger bluebox up to and including version 4.5.12. The vulnerability occurs due to insufficient input validation or sanitization of the 'code' argument in an unknown functionality, enabling remote attackers to inject malicious scripts. The vulnerability was publicly disclosed and the project was notified early via an issue report. No official patch or remediation level has been indicated in the available data.

Successful exploitation allows remote attackers to perform cross-site scripting attacks, potentially leading to execution of arbitrary scripts in the context of the affected application. This can result in user session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction (UI:P) and has low complexity (AC:L) with no privileges required (PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation or filtering on the 'code' parameter if possible as a temporary mitigation.