CVE-2026-57617 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability affecting SeedProd Pro before version 6.19.5. The issue allows contributor-level users to perform cross-site scripting (XSS) attacks by injecting malicious input that is not properly sanitized. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the contributor level, user interaction required, and impacts on confidentiality, integrity, and availability at low levels with scope changed. There is no vendor advisory or patch information available at this time.

An attacker with contributor privileges can exploit this vulnerability to execute arbitrary scripts in the context of the affected application. This can lead to partial compromise of confidentiality, integrity, and availability of the application or user data. The vulnerability requires user interaction and privileges at the contributor level, limiting its exploitation scope. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level privileges to trusted users and monitor for suspicious activity related to script injection. Avoid granting unnecessary contributor access.