A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-6824) affects CP Plus 8 Channel Network Video Recorder devices due to insufficient input sanitization. The vulnerability allows attackers to inject malicious scripts that execute in browsers of authenticated users and administrators, potentially leading to session hijacking, unauthorized actions, and data theft. The vulnerability has a CVSS score of 8.4 (HIGH severity) and affects specific versions of CP-UNR-108F1 devices. CP Plus recommends updating firmware to the latest version to mitigate the risk.