CVE-2026-42877 is a stored XSS vulnerability in NeoRazorX's FacturaScripts accounting software (versions 2025.92 and earlier). The flaw exists in the product search modal for sales and purchase documents, specifically in the files Core/Lib/AjaxForms/SalesModalHTML.php and PurchasesModalHTML.php. An authenticated user with access to the warehouse module can create a product with a malicious reference string that executes arbitrary JavaScript in the context of other users who open the product search modal within invoices, orders, or delivery notes. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 5.4, indicating medium severity.

Successful exploitation allows an authenticated user to execute arbitrary JavaScript in other users' browsers when they access the product search modal. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions within the application context. There is no impact on system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict warehouse module access to trusted users only and consider monitoring for suspicious activity related to product creation. Avoid opening product search modals from untrusted sessions. No official patch or workaround has been published at this time.