This vulnerability (CVE-2026-57428) affects BoldGrid Sprout Clients versions up to and including 3.2.3. It is an unauthenticated cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation (CWE-79). The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can allow attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, and disruption of service. The CVSS vector indicates limited but non-negligible impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor vendor communications for updates. Until a patch is available, consider applying web application firewalls or input validation controls as interim mitigations, if feasible.