CVE-2026-14752 is a medium severity cross-site scripting vulnerability in the mjperpinosa stumasy product. It affects the add_definition function in the file application/PHP/objects/notes/add_into_dictionary.php, where manipulation of the argument 'reference' can lead to XSS. The vulnerability can be exploited remotely without privileges or user interaction. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vendor has been informed but has not yet issued a response or patch. No official remediation or patch is currently available.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires no privileges and no user interaction but has limited impact due to the medium CVSS score and lack of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a fix is available, consider applying input validation or output encoding workarounds if feasible to mitigate the risk of XSS in the affected function.