CVE-2026-66598 is an unauthenticated cross-site scripting (CWE-79) vulnerability in B2BKing Premium versions up to and including 5.6.07. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in the context of the victim's browser. The vulnerability has a CVSS 3.1 base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to partial loss of confidentiality, integrity, and availability of affected systems. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users of affected versions. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying web application firewalls or input validation controls as temporary mitigations. Monitor vendor communications for updates on patches or official mitigations.