CVE-2026-15505 is a medium-severity cross-site scripting vulnerability affecting vnotex vnote up to versions 3.20.0 and 3.20.1. The vulnerability arises from improper handling of the p_metaData argument in the YAML Frontmatter component of the markdownit.js file. This flaw allows remote attackers to execute script code in the context of the affected application. The vendor was contacted but did not provide any response or remediation guidance. No patch or official fix has been published as of the disclosure date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the vulnerable component. This may lead to session hijacking, defacement, or other malicious actions performed with the victim's privileges. The CVSS 4.0 base score is 5.1, indicating a medium impact with network attack vector, low attack complexity, and requiring user interaction with low integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying workarounds such as disabling or restricting the use of the affected YAML Frontmatter feature if possible, or employing web application firewalls to detect and block XSS payloads targeting this component. Monitor official vendor channels for updates or patches.