CVE-2026-42877 is a stored Cross-Site Scripting vulnerability in FacturaScripts (NeoRazorX) affecting versions up to 2025.92. The flaw exists in the product search modal for sales and purchases documents (specifically in Core/Lib/AjaxForms/SalesModalHTML.php and PurchasesModalHTML.php). An authenticated user with access to the warehouse module can create a product with a malicious reference string that, when viewed by other users in the product search modal inside invoices, orders, or delivery notes, executes arbitrary JavaScript code in their browsers. This vulnerability arises from improper neutralization of input during web page generation (CWE-79).

Successful exploitation allows an authenticated user with warehouse module access to execute arbitrary JavaScript in the browsers of other users who open the affected product search modal. This can lead to information disclosure or session hijacking limited to users who interact with the vulnerable interface. The vulnerability does not impact availability and requires user interaction (opening the modal). No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict warehouse module access to trusted users only and consider monitoring for suspicious activity related to product references. Avoid opening the product search modal in untrusted environments if possible.