CVE-2026-15202 is a medium severity cross-site scripting vulnerability affecting YzmCMS versions 7.0 to 7.5. The vulnerability arises from improper sanitization of the HTTP_HOST argument in the get_url function of the /yzmphp/yzmphp.php file, part of the Header Handler component. An attacker can remotely exploit this flaw by manipulating HTTP_HOST to execute arbitrary scripts in the context of the victim's browser. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch. No known exploits are reported in the wild at this time.

Successful exploitation of this vulnerability allows remote attackers to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in users' browsers. This can result in session hijacking, defacement, or redirection to malicious sites. However, the impact is limited to user interaction (user interface required) and does not involve privilege escalation or system compromise.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should consider implementing web application firewall (WAF) rules to filter or block malicious HTTP_HOST inputs as a temporary mitigation. Monitoring for suspicious activity related to HTTP_HOST manipulation is advised. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.