This vulnerability (CVE-2024-32534) in Form Maker by 10Web is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It allows an attacker with high privileges and requiring user interaction to inject malicious scripts that can execute in a context with limited confidentiality, integrity, and availability impact. The vulnerability affects all versions up to 1.15.23. No official fix or vendor advisory detailing remediation is currently available, and the product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when viewed by other users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and a scope change. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor for vendor updates and avoid granting unnecessary high privileges until a patch is available. No vendor advisory indicates that the issue is already mitigated or requires no action.