CVE-2026-81768: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in highwarden Super Store Finder

This vulnerability, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), affects Super Store Finder software versions up to 7.10. It enables unauthenticated attackers to perform cross-site scripting (XSS) attacks by injecting malicious input that is not properly sanitized before being included in web pages. The CVSS 3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure, modification, or denial of service. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider applying web application firewall (WAF) rules to detect and block XSS attempts and review input validation and output encoding configurations if possible.