CVE-2026-65527

The vulnerability exists in versions 1.2.5 and earlier of Liquid Speech Balloon, where a Contributor Cross Site Scripting (XSS) flaw allows attackers to inject malicious scripts into web pages viewed by users. This could lead to unauthorized actions or data exposure, impacting the security of web applications utilizing this software. Organizations using affected versions should prioritize patching to mitigate potential exploitation risks.