This vulnerability (CVE-2026-56072) affects Xtemos WoodMart versions up to 8.5.3 and is classified as CWE-79, indicating improper neutralization of input during web page generation, resulting in Cross-Site Scripting (XSS). The flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS v3.1 score is 7.1 (high), with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes limited confidentiality, integrity, and availability losses. No patch or official remediation is currently documented.

Successful exploitation of this vulnerability can allow an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected WoodMart web pages. This can lead to partial disclosure of sensitive information, modification of web content, and potential disruption of service. The CVSS score reflects a high severity with impacts on confidentiality, integrity, and availability, but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewall (WAF) rules to detect and block XSS attempts and follow best practices for input validation and output encoding in their deployment. Monitor vendor channels for updates.