CVE-2026-57431 is a CWE-79 cross-site scripting vulnerability in the Mervin Praison Featured Image product. It affects all versions up to and including 2.1. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with network access and low privileges to execute scripts in the context of another user, contingent on user interaction. The CVSS 3.1 base score is 6.5, indicating medium severity with impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a victim user, potentially leading to information disclosure, modification of data, or disruption of service. The attack requires user interaction and low privileges but can affect confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and applying any available input validation or web application firewall rules to mitigate potential exploitation.