CVE-2026-70560 describes a stored cross-site scripting vulnerability in Ultimate POS (Stock Management & Point of Sale). Low-privileged authenticated attackers, such as users with the Cashier role, can inject arbitrary HTML and script markup by submitting a malicious payload in the first-name field during account creation. When a higher-privileged user views the leave-application notification pane, the unsanitized payload executes in their browser context, enabling cross-user session compromise within the admin origin. The vulnerability arises from improper neutralization of input during web page generation.

An attacker with low privileges can inject malicious scripts that execute in the context of higher-privileged users, potentially leading to session compromise or other actions performed with the higher privileges. This could allow unauthorized actions or data access within the admin interface of Ultimate POS. However, exploitation requires authenticated access and user interaction (viewing the notification pane).

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict low-privileged user input where possible and limit access to the HRM/Leave module notifications to trusted users only.