CVE-2026-88420 is a reflected XSS vulnerability in the EntryAbstract.save() component of APSL puput, affecting versions 1.2.1 through 2.2.0 inclusive. Authenticated attackers who have Wagtail Editor privileges can exploit this vulnerability by submitting crafted payloads that execute arbitrary code within the victim's browser context. This vulnerability arises from insufficient input sanitization or output encoding in the affected component, enabling script injection that is reflected back to the user.

Successful exploitation allows an attacker with Wagtail Editor privileges to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, unauthorized actions on behalf of the victim, or other malicious activities within the web application session. The impact is limited to authenticated users with specific editor privileges, reducing the attack surface to trusted users.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Wagtail Editor privileges to trusted users only and consider additional input validation or output encoding controls in the affected component to mitigate exploitation risk.