CVE-2026-26291 is a stored cross-site scripting vulnerability affecting GROWI, Inc.'s GROWI product versions 7.4.6 and earlier. Successful exploitation allows an attacker to inject and execute arbitrary scripts in the context of a user's browser session. The vulnerability has a CVSS 3.0 base score of 5.4, indicating medium severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality and integrity with no availability impact. No official remediation or patch information is currently provided by the vendor, and the product is not a cloud service, so remediation depends on user-side updates.

If exploited, this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to unauthorized actions or data disclosure within the context of the affected GROWI application. The impact is limited to confidentiality and integrity with no direct availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying any available workarounds or temporary mitigations recommended by the vendor once available.