CVE-2026-71285 describes a stored Cross-Site Scripting (XSS) vulnerability in Uptime Kuma's Matomo analytics integration. The vulnerability exists in server/analytics/matomo-analytics.js, where the admin-configurable Matomo siteId value is injected as an unquoted JavaScript expression inside a script block on every public status page. The escaping pipeline using jsesc and html-escaper fails to sanitize characters such as ], ), ;, and (, allowing breakout from the array/push expression context. An attacker with editor or admin privileges can craft a malicious siteId value to execute arbitrary JavaScript for every unauthenticated visitor of public status pages. This enables session-cookie theft and full page takeover for all visitors. The impact is significant as public-facing status pages are typically accessible without authentication, broadening the attack surface considerably.