This vulnerability in 10Web Form Maker (<= 1.15.33) involves improper neutralization of input during web page generation, leading to Stored Cross-site Scripting (XSS). An attacker with high privileges and requiring user interaction can inject malicious scripts that execute in the context of other users' browsers, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 5.9, reflecting medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

Successful exploitation could allow an attacker with high privileges to inject persistent malicious scripts that execute when other users view affected pages, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is assessed as medium severity with partial confidentiality, integrity, and availability impacts. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access to trusted personnel only and consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates and patches addressing this vulnerability.