The vulnerability identified as CVE-2026-88261 affects bizwell xClick versions R2 and R3. It is classified as CWE-20, indicating improper input validation. This flaw allows an attacker to inject stored cross-site scripting (XSS) payloads, potentially leading to script execution in the context of affected users. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed, with low impact on confidentiality and no impact on integrity or availability.

Successful exploitation of this vulnerability can result in stored XSS attacks, which may allow attackers to execute malicious scripts in the browsers of users interacting with the affected application. This can lead to session hijacking, defacement, or other client-side impacts. However, the impact is rated medium severity and there are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation controls or web application firewalls to mitigate stored XSS risks.