CVE-2026-4378: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack

This vulnerability (CVE-2026-4378) involves improper input neutralization in the E-Commerce Pack by Akilli Ticaret Software Technologies Ltd., leading to stored cross-site scripting (CWE-79). The affected versions include 4.5.001 up to but excluding 4.6.001. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges and user interaction, with impact on confidentiality and integrity but not availability. No known exploits are reported in the wild, and no patch links or vendor advisories are available to confirm remediation status.

Successful exploitation allows an attacker to inject and store malicious scripts that execute in the context of users' browsers, potentially leading to data disclosure or integrity issues. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and low privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates.