The vulnerability identified as CVE-2026-66603 affects David Artiss Draft List versions up to 2.6.4. It is a stored cross-site scripting (CWE-79) flaw caused by improper neutralization of input during web page generation. This allows an attacker with limited privileges to inject malicious scripts that can execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and low impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with some privileges to inject and store malicious scripts that execute in other users' browsers. This can lead to partial disclosure of information, modification of data, and disruption of service within the affected application context. The scope of impact extends beyond the vulnerable component, affecting other components or users.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user privileges to limit potential exploitation and consider applying web application firewall (WAF) rules to detect and block XSS payloads relevant to this vulnerability.