CVE-2026-7429 is a reflected cross-site scripting vulnerability in siteserver SSCMS version 7.4.0. It arises from improper output encoding in the /api/stl/actions/dynamic endpoint, where malicious STL template payloads are decrypted and returned without proper sanitization. This allows attackers to inject arbitrary JavaScript into JSON responses, potentially enabling session hijacking, phishing, or unauthorized actions performed on behalf of users. The vulnerability is classified under CWE-79 and has a CVSS 4.0 base score of 2.1, reflecting low severity. No patch or official remediation is currently documented, and no exploits are known in the wild.

The vulnerability enables attackers to execute arbitrary JavaScript in the context of affected users by injecting malicious code into JSON responses. This can lead to session hijacking, phishing attacks, or unauthorized actions performed with the privileges of the victim user. However, the low CVSS score indicates limited impact or exploitability, possibly due to required user interaction or limited scope of the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected endpoint and applying any available input validation or output encoding workarounds if feasible. Monitor vendor communications for updates on patches or mitigations.