This vulnerability (CVE-2026-42649) is an unauthenticated Cross-Site Scripting (XSS) issue in Archetyped's Favicon Rotator product, affecting versions up to 1.2.11. The root cause is improper neutralization of input during web page generation, classified under CWE-79. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and a scope change with low impact on confidentiality, integrity, and availability. No vendor advisory or patch information is available at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject malicious scripts into web pages generated by Favicon Rotator, potentially leading to partial compromise of user data confidentiality, integrity, and availability. The CVSS score indicates a high severity with scope change, meaning the vulnerability can affect components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds or input validation controls if feasible. Monitor vendor communications for updates on patches or official mitigations.