CVE-2026-27505 is a stored cross-site scripting vulnerability in SVXportal version 2.5 and prior. The vulnerability arises because user-supplied input fields in the registration workflow are stored in the backend database without adequate output encoding. These fields are subsequently displayed in the administrator interface (admin/users.php) without proper sanitization, enabling an unauthenticated remote attacker to inject and execute arbitrary JavaScript in the context of the administrator's browser. This can lead to session hijacking, unauthorized actions, or other malicious activities performed with administrator privileges.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary JavaScript in the administrator's browser. This could potentially allow the attacker to perform actions with administrator privileges, steal session tokens, or manipulate the administrator interface. The impact is limited to the administrator's browser context and depends on the administrator viewing the maliciously crafted user data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when reviewing user-submitted data in the affected interface. Implementing manual output encoding or filtering on the user input fields before rendering them in the administrator interface can mitigate the risk. Monitoring vendor communications for updates or patches is recommended.