CVE-2026-14704 describes a cross-site scripting vulnerability in the stephen-kruger bluebox product affecting versions up to 4.5.12. The vulnerability arises from improper handling of the 'code' argument, enabling remote attackers to inject malicious scripts. The vulnerability is exploitable remotely without privileges or user interaction beyond triggering the vulnerable parameter. The exploit details have been publicly disclosed, but no official fix or patch has been documented as of the published date.

Successful exploitation allows an attacker to perform cross-site scripting attacks, potentially leading to script execution in the context of the victim's browser. This can result in session hijacking, defacement, or other malicious actions depending on the victim's interaction with the affected application. The vulnerability requires user interaction (UI:P) and has low complexity (AC:L). No elevated privileges or user authentication is required to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor the vendor's communications for updates. Until a patch is available, consider applying input validation or sanitization on the 'code' parameter if possible, or implement web application firewalls to detect and block XSS payloads targeting this parameter.