CVE-2026-7429 describes a reflected cross-site scripting vulnerability in siteserver SSCMS version 7.4.0. The vulnerability arises from improper output encoding in the STL processing endpoint (/api/stl/actions/dynamic), where malicious STL template payloads are decrypted and returned without adequate sanitization. This allows attackers to inject arbitrary JavaScript into JSON responses, potentially enabling session hijacking, phishing, and unauthorized actions performed on behalf of users. The CVSS 4.0 vector indicates network attack vector, low complexity, partial privileges required, user interaction needed, and low impact on confidentiality and integrity. No patch or official remediation level is currently documented.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the affected web application, which may result in session hijacking, phishing attacks, and unauthorized actions performed by the victim user. However, the overall impact is rated low due to the CVSS score of 2.1 and the requirement for user interaction and partial privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when processing STL templates from untrusted sources and consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates regarding patches or official mitigations.