This vulnerability (CVE-2026-5005) is a stored cross-site scripting (CWE-79) flaw in the OKRs & Goals product by Twiser Informatics Technology Consulting, Trade and Education Inc. It results from improper input neutralization during web page generation, allowing malicious scripts to be stored and later executed in users' browsers. The affected version is exactly 28220. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and limited confidentiality and integrity impact but no availability impact. No official fix or remediation guidance has been published as of the data provided.

Successful exploitation could allow an attacker to execute stored malicious scripts in the context of the affected application, potentially leading to limited confidentiality and integrity impacts such as theft or manipulation of user data within the application session. There is no reported impact on availability. The vulnerability requires user interaction and low privileges but can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for updates on patches or official workarounds.