CVE-2026-85406: Cross Site Scripting in Eleveo Quality Management

This vulnerability in Eleveo Quality Management 9.7.0 involves a cross-site scripting flaw in the Conversation Review component. It allows remote attackers to execute scripts in the context of the affected application by manipulating input that is not properly sanitized. The vulnerability requires low attack complexity and no privileges but does require user interaction. The vendor was notified but has not issued a response or patch. Public exploit details are available, increasing the risk of exploitation.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the vulnerability does not allow privilege escalation or server-side code execution. The medium CVSS score reflects moderate impact with some user interaction required.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the Conversation Review component. Educate users to be cautious with suspicious links or inputs related to this application.