CVE-2026-4972: XSS in Online Reviewer System

Successful exploitation of CVE-2026-4972 allows an attacker to inject arbitrary JavaScript code into the Online Reviewer System. This code can then be executed in the context of a victim's browser when they access a vulnerable page. The impact ranges from session hijacking and defacement to the theft of sensitive information, such as user credentials or personal data. The remote nature of the vulnerability means attackers do not need local access to exploit it. While the CVSS score is LOW, the potential for widespread impact through user interaction should not be underestimated, particularly in environments with many users.

1. Reserved2026-03-27
2. Published2026-03-27
3. EPSS updated2026-04-04

The primary mitigation for CVE-2026-4972 is to upgrade to a patched version of the Online Reviewer System (a fixed version is not specified in the provided data). In the absence of a patch, implement robust input validation on the 'Description' argument within btn_functions.php to prevent the injection of malicious scripts. Strict output encoding, particularly when displaying user-supplied data, is also crucial. Consider implementing a Web Application Firewall (WAF) with rules to detect and block XSS attempts targeting this specific vulnerability. Review and update existing security policies to emphasize the importance of secure coding practices and regular vulnerability scanning.