CVE-2026-40286 is a stored cross-site scripting vulnerability (CWE-79) in WeGIA versions before 3.6.10. It allows an attacker to inject malicious scripts into the 'Member Name' field during member registration. The injected payload is stored persistently in the backend database and executes in the context of users who access affected pages, potentially leading to script execution without user interaction. This vulnerability is fixed in version 3.6.10.

Successful exploitation results in the execution of attacker-controlled scripts in the browsers of users who visit affected pages, potentially leading to unauthorized actions performed in the context of the victim user. The CVSS vector indicates no confidentiality or availability impact but a high integrity impact, meaning attackers can manipulate or inject malicious content affecting data integrity.

Upgrade WeGIA to version 3.6.10 or later, which fixes this stored XSS vulnerability. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No other mitigation steps are indicated in the advisory.