CVE-2026-96339: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Houzez.co Houzez

This vulnerability involves improper neutralization of input during web page generation in Houzez.co's Houzez product, leading to a reflected cross-site scripting (XSS) issue. It affects all versions from initial release up to and including 4.4.0. The vulnerability allows an attacker to inject malicious scripts that are reflected back to users, potentially impacting confidentiality, integrity, and availability as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No vendor advisory or patch information is currently available.

Successful exploitation of this reflected XSS vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The attacker can execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious actions. The CVSS score of 7.1 reflects a high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates or patches addressing this vulnerability.