CVE-2026-14752 is a medium severity cross-site scripting vulnerability in the mjperpinosa stumasy product. It affects the add_definition function in the file application/PHP/objects/notes/add_into_dictionary.php. The vulnerability arises from improper handling of the reference argument, allowing remote attackers to inject malicious scripts. The product uses a rolling release model, so no explicit affected or fixed versions are available. The vendor was notified early but has not provided a response or patch. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to perform cross-site scripting attacks by injecting malicious scripts via the reference argument to the add_definition function. This can lead to client-side script execution in the context of the affected application, potentially compromising user data or session integrity. The CVSS 4.0 score of 5.1 reflects a medium impact with low attack complexity and no privileges required but user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. In the meantime, consider applying input validation or sanitization controls on the reference argument if possible, or restrict access to the vulnerable functionality to trusted users only.