CVE-2026-27420: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Katie Seaborn Zotpress

This vulnerability in Zotpress involves improper sanitization of input that is incorporated into web pages, leading to stored cross-site scripting (XSS). Attackers can inject malicious scripts that persist on the affected site and execute in the context of users' browsers, potentially leading to information disclosure, session hijacking, or other impacts. The affected versions include all releases up to 7.4.4.

Successful exploitation can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This means attackers may be able to steal sensitive information, modify content, or disrupt availability to some extent via the stored XSS vulnerability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the affected Zotpress versions and apply any recommended input sanitization or filtering measures if possible.