This vulnerability (CVE-2026-27408) is an instance of CWE-79, where NativeChurch versions <= 4.8.8.2 fail to properly sanitize user input before including it in web pages. The flaw enables unauthenticated attackers to inject malicious scripts, resulting in Cross-Site Scripting (XSS). The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to data theft, session hijacking, or other malicious actions that affect confidentiality, integrity, and availability of the application or user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended temporary mitigations from the vendor or restrict access to vulnerable instances. Monitor vendor channels for updates and apply patches promptly once released.