CVE-2026-53907 is a stored Cross-Site Scripting (XSS) vulnerability in MyComplianceOffice (MCO) version 25.3.3.1. The issue arises from improper neutralization of input during web page generation (CWE-79) in the application logo upload functionality. An attacker with the ability to change the application logo can upload a malicious SVG file containing JavaScript code that executes when the logo is rendered or opened by users. Attempts to contact the vendor for remediation have been unsuccessful, and no patch or fix has been published. The vulnerability has a CVSS 4.8 (medium) score, indicating moderate risk with network attack vector, low complexity, and required privileges.

Successful exploitation allows an attacker with privileges to change the application logo to execute arbitrary JavaScript in the context of users viewing the logo. This can lead to session hijacking, information disclosure, or other client-side impacts typical of stored XSS vulnerabilities. The vulnerability requires the attacker to have some level of privilege (high) and user interaction (UI required). There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Since the vendor has not responded to contact attempts, users should restrict permissions to change the application logo to trusted administrators only and monitor for suspicious SVG uploads. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.