CVE-2026-32574: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EDGARROJAS Smart Forms

CVE-2026-32574 is an unauthenticated cross-site scripting (XSS) vulnerability in EDGARROJAS Smart Forms versions up to and including 2.6.104. The issue arises from improper neutralization of input during web page generation, classified under CWE-79. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes low confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability of the system or user data. The vulnerability does not require authentication, increasing its risk. However, no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor vendor communications for updates. Until a fix is available, consider applying input validation or web application firewall rules to mitigate potential exploitation.