CVE-2026-34907 is a reflected Cross-Site Scripting (XSS) vulnerability in Simple SA's Wirtualna Uczelnia product. The vulnerability arises from improper neutralization of input in the locale parameter across multiple endpoints, allowing injection of malicious JavaScript code. When a victim accesses a crafted URL, the injected script executes in their browser context. This issue affects versions up to wu#2016.437.295#0#20260327_105545. The CVSS 4.0 score is 5.1 (medium severity). No official patch or remediation level has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability enables an attacker to execute arbitrary JavaScript in the context of the victim's browser session when they visit a maliciously crafted URL. This can lead to session hijacking, information disclosure, or other client-side impacts typical of reflected XSS. However, there is no indication of privilege escalation or server-side compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking on untrusted links containing locale parameters in Wirtualna Uczelnia. Implementing web application firewall (WAF) rules to detect and block suspicious input in the locale parameter may provide temporary mitigation.