CVE-2026-53737 is a cross-site scripting vulnerability in saas.group's Juicer product affecting versions through 1.12.18. The issue arises because Juicer fails to properly escape fields from remote feed API responses before rendering them on the admin settings page. An attacker controlling the feed data can inject malicious scripts that execute in the context of an administrator's browser, potentially leading to session hijacking or other browser-based attacks. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows an attacker controlling the connected feed data to execute arbitrary scripts in the administrator's browser when they load the settings page. This can lead to theft of session tokens, unauthorized actions performed with administrator privileges, or other client-side attacks. The impact is limited to administrators who access the affected settings page and does not require privileges or user interaction beyond visiting the page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid loading the affected settings page with untrusted feed data. Restricting access to the admin interface and validating or sanitizing feed data before it is used may reduce risk. Monitor vendor channels for updates or patches addressing this vulnerability.