CVE-2026-38931 is a stored XSS vulnerability in the /admin/config-module.php component of creatorsofcode simplephp, identified in the GitHub commit 5184cff as of 2026-02-27. The vulnerability allows an attacker with low privileges and requiring user interaction to inject malicious scripts that persist in the application, potentially leading to partial compromise of confidentiality and integrity. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope changed. No known exploits in the wild or vendor advisories are currently available.

Successful exploitation can result in partial loss of confidentiality and integrity due to stored XSS, potentially allowing attackers to execute malicious scripts in the context of affected users. There is no impact on availability. The attack requires low privileges and user interaction, and it can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the /admin/config-module.php component to trusted users only and consider implementing input validation and output encoding as temporary mitigations to reduce the risk of stored XSS.