CVE-2026-15505 is a medium severity cross-site scripting vulnerability affecting vnotex vnote versions 3.20.0 and 3.20.1. The vulnerability arises from improper handling of the p_metaData argument in the YAML Frontmatter component of the markdownit.js file, allowing remote attackers to execute arbitrary scripts in the context of the affected application. The vendor was contacted but did not provide a response or remediation. No known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability requires low privileges and user interaction but can be initiated remotely.

No official fix or patch is currently available from the vendor, as they have not responded to the disclosure. Users should monitor the vendor's communications for any future updates or patches. In the meantime, consider applying application-level input sanitization or filtering on the p_metaData input if feasible, or restrict access to vulnerable versions until a fix is released.