CVE-2026-6633 is a cross-site scripting vulnerability in Yifang CMS up to version 2.0.5. It affects the store function in the Extended Management Module's admin logic file (plugins/yifang_backend_account/logic/admin/L_rbac_admin.php). The vulnerability is triggered by manipulation of the Account argument, which is not properly sanitized, enabling remote attackers to inject and execute malicious scripts. The vulnerability is remotely exploitable without requiring elevated privileges but does require user interaction. The vendor has not provided a fix or response, and no official remediation guidance is available.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the victim's browser. This can result in session hijacking, defacement, or other malicious actions performed on behalf of the user. Since the vulnerability is remotely exploitable and public exploit code is available, affected systems are at increased risk. However, no confirmed active exploitation in the wild has been reported.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Users of Yifang CMS versions up to 2.0.5 should consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the Account parameter in the Extended Management Module. Additionally, restricting access to the affected module and monitoring for suspicious activity may reduce risk. Check the vendor's website or trusted security advisories regularly for any updates or official fixes.