CVE-2026-7429 is a reflected cross-site scripting vulnerability (CWE-79) in siteserver SSCMS version 7.4.0. The issue arises from improper output encoding in the /api/stl/actions/dynamic endpoint, where malicious STL template payloads are decrypted and returned without adequate sanitization. This allows attackers to inject arbitrary JavaScript into JSON responses, potentially enabling session hijacking, phishing, or unauthorized user actions. The vulnerability has a CVSS 4.0 score of 2.1, reflecting low severity. No patch or official remediation level has been published by the vendor, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary JavaScript in the context of affected users' browsers. This may lead to session hijacking, phishing attacks, or unauthorized actions performed on behalf of users. However, the CVSS score of 2.1 and the low severity rating indicate that the overall impact and exploitability are limited. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider applying input validation or output encoding controls at the application or web server level if feasible. Avoid using the vulnerable endpoint with untrusted input where possible.