CVE-2026-55730 is a reflected cross-site scripting vulnerability in Loytec LWEB-802 prior to version 5.0.8. The issue arises from improper neutralization of input during web page generation, specifically involving the 'project' or 'mspParams' parameters. An unauthenticated attacker can exploit this by sending a crafted link that executes arbitrary JavaScript in the context of the victim's browser, potentially allowing actions with the victim's privileges. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript in the victim's browser, which can lead to actions performed with the victim's privileges. This can result in session hijacking, unauthorized actions, or other malicious activities within the context of the affected web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on links containing 'project' or 'mspParams' parameters and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns related to these parameters.