CVE-2026-40229 is a stored cross-site scripting vulnerability in helpy version 2.8.0. It arises from improper neutralization of input during web page generation (CWE-79) in the post author display logic. Specifically, any registered user can insert arbitrary HTML into their account name field, which is then rendered without escaping in multiple contexts including public forum threads, the admin ticket view, and HTML notification emails. This can lead to persistent XSS attacks affecting users who view these pages or emails.

The vulnerability allows an attacker with a registered user account to inject malicious HTML/JavaScript code that is persistently stored and executed in the browsers of other users and administrators. This can lead to session hijacking, phishing, or other malicious actions within the context of the affected application. The impact is rated medium with a CVSS 4.0 score of 5.1, reflecting the need for user interaction and limited scope of privilege required.

No official patch or remediation is currently available for this vulnerability. Users and administrators should monitor the vendor's advisory channels for updates. In the meantime, restricting user input in the account name field to disallow HTML or implementing server-side output encoding can mitigate the risk. Since this is a stored XSS, careful review of user-generated content rendering is advised. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.