CVE-2026-5218: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) in Softtr Informatics Technology Trading Limited Company E-Commerce Pack

This vulnerability (CWE-80) in Softtr Informatics Technology Trading Limited Company's E-Commerce Pack allows an attacker to inject malicious script code due to improper neutralization of script-related HTML tags in web pages. The flaw enables Cross-Site Scripting (XSS) attacks, which can be triggered by user interaction (UI required). The vulnerability affects versions prior to 5.03.01.49. The CVSS 3.1 base score is 4.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No known exploits are reported in the wild, and no vendor remediation or patch information is currently provided.

The vulnerability allows an attacker to perform Cross-Site Scripting (XSS) attacks, potentially leading to limited impact such as injection of script code that could affect user experience or session integrity. The CVSS score reflects no confidentiality or availability impact, only low integrity impact. No evidence of active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block XSS attempts. Monitor vendor channels for updates on patches or official mitigations.