The vulnerability CVE-2026-27074 in vaakash Shortcoder is a stored cross-site scripting issue caused by improper input neutralization during web page generation. This allows attackers with low privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The affected versions include all versions up to 6.5.1. No patch or official remediation details are provided in the available data.

Successful exploitation could lead to execution of arbitrary scripts in the context of users viewing the affected content, potentially resulting in limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and partial impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates regarding patches or official fixes.