CVE-2026-44956 is a stored XSS vulnerability in Revive Adserver. Low-privileged users can inject malicious JavaScript into their Full Name, which is embedded in system-generated emails and stored in the userlog table's details field. Admin users viewing these emails through userlog-details.php would have the payload executed because of missing output sanitization. The vendor has since implemented proper escaping on the userlog details output to mitigate this vulnerability.

The vulnerability allows stored XSS attacks that could execute arbitrary JavaScript in the context of an admin user's browser when viewing userlog email details. This could lead to session hijacking, privilege escalation, or other malicious actions performed by the admin user. However, no direct confidentiality, integrity, or availability impact is described, and no known exploits are reported in the wild.

Proper escaping has been added to the userlog details output by the vendor to mitigate this vulnerability. No official patch or remediation level is explicitly stated in the available data. Users should verify that their Revive Adserver installation includes this fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.