CVE-2026-66616: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in 10Web Form Maker by 10Web

The vulnerability CVE-2026-66616 in 10Web Form Maker is a Stored Cross-site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that persist on the affected web pages, potentially executing in users' browsers when they view the compromised content. The issue affects all versions from 0 up to and including 1.15.48. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low to low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability to a limited extent.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation and output encoding controls where possible to mitigate XSS risks.