CVE-2026-6793 describes a stored cross-site scripting (XSS) vulnerability in Q-smart NexT Poll by Bifra Engineering Consulting Ltd. The issue arises from improper input neutralization during web page generation, enabling attackers with low privileges and requiring user interaction to inject and execute malicious scripts. This vulnerability affects all versions prior to 1.8.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, scope changed, and low impact on confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to information disclosure or manipulation of user interactions. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires user interaction and low privileges, reducing the ease of exploitation.

No official patch or remediation level has been confirmed yet. Users of Q-smart NexT Poll should upgrade to version 1.8.7 or later once available. Until a patch is released, apply input validation and output encoding as a temporary mitigation to reduce the risk of stored XSS. Monitor vendor advisories for updates on official fixes.