CVE-2026-39727: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Saravana Kumar K WC Fields Factory

This vulnerability, identified as CWE-79, affects WC Fields Factory versions up to and including 4.1.12. It allows an attacker with low privileges and requiring user interaction to inject malicious scripts due to improper input neutralization during web page generation. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, privileges required, user interaction, and partial impact on confidentiality, integrity, and availability.

Successful exploitation can lead to partial disclosure of information, modification of data, and limited disruption of service. The attack requires user interaction and privileges, limiting its scope but still posing a risk to affected users and systems.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible.