This vulnerability is a reflected XSS issue in the dfm-menu_coveragealerts.php component of docuForm v11.11c. An attacker can craft a malicious payload that is injected into an unfiltered variable, causing the victim's browser to execute arbitrary JavaScript. The vulnerability was published on May 11, 2026, but no CVSS score or remediation details have been provided. The affected product is not a cloud service, and no exploits have been reported in the wild.

Successful exploitation allows execution of arbitrary JavaScript in the context of the user's browser, which can lead to theft of session tokens, defacement, or other client-side attacks. However, no active exploitation has been reported, and the overall impact depends on the context in which the vulnerable component is used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor communications for updates on patches or official workarounds.