CVE-2026-88261
Received Received - Intake

Stored XSS in bizwell xClick

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: FSI

Description
Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-10-05
AI Q&A
2026-09-15
EPSS Evaluated
2026-10-04
NVD
CVE-2026-88261
EUVD
EUVD-2026-78254

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bizwell xclick From R2 (inc) to R3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in bizwell xClick versions R2, R3, and R3.1. It occurs due to improper input validation, allowing attackers to inject malicious scripts that are stored on the server and executed when other users access the affected pages.

Detection Guidance

Detecting this vulnerability requires checking for stored XSS in bizwell xClick versions R2, R3, and R3.1. Manually inspect input fields and stored data for malicious scripts. Use browser developer tools to monitor network requests and responses for suspicious payloads. Check application logs for unusual input patterns or errors related to script execution.

Impact Analysis

An attacker could exploit this to steal user sessions, deface web pages, or redirect users to malicious sites. Users with access to the system may unknowingly execute harmful scripts, leading to data theft or unauthorized actions.

Compliance Impact

Stored XSS can lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance due to potential breaches of confidentiality and integrity of sensitive data.

Mitigation Strategies

Apply the latest security patches or updates for bizwell xClick versions R2, R3, and R3.1 to address the improper input validation issue. Disable or restrict access to xClick if patches are not immediately available. Monitor network traffic for suspicious XSS-related activities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88261. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart