The vulnerability identified as CVE-2026-23973 affects uxper Golo versions before 1.7.5. It is a reflected cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that are reflected in the web response, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to data disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS vector indicates limited but real impact on all three security properties. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from uxper and apply any official patches once available. Until then, consider applying web application firewall (WAF) rules or input validation controls to mitigate reflected XSS risks.