The vulnerability CVE-2026-57415 in Codemenschen Gift Vouchers is a Stored Cross-Site Scripting (XSS) issue caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that are stored and later executed in the context of users' browsers, potentially leading to partial compromise of confidentiality, integrity, and availability. The affected product versions include all versions up to and including 4.7.0. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, but requires user interaction. The scope is changed, and the impact is low on confidentiality and integrity, and low on availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users' browsers when they view affected pages. This can lead to partial disclosure of sensitive information, modification of displayed content, or disruption of availability. The CVSS score of 7.1 reflects a high severity with impacts on confidentiality, integrity, and availability, though the attack requires user interaction and no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input in the affected application. Implementing web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation. Avoid clicking on suspicious links or inputs that could trigger stored XSS. Monitor vendor channels for updates on patches or official mitigations.