The vulnerability CVE-2026-8308 in Polen Media Software and Information Services Website Template is a reflected cross-site scripting (CWE-79) flaw caused by improper input neutralization during web page generation. This allows attackers to inject malicious scripts that can be reflected back to users, potentially leading to information disclosure or session hijacking. The affected product versions are all versions before 2. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website for users who visit a crafted URL. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. Availability is not impacted. The CVSS vector indicates the attack requires no privileges but user interaction is needed, and the attack scope is changed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and output encoding as temporary mitigations to reduce the risk of reflected XSS. Monitor vendor channels for updates.