This vulnerability (CVE-2026-66633) is classified as CWE-79, indicating improper neutralization of input during web page generation, leading to cross-site scripting (XSS). It affects the Fluent Forms Pro Add On Pack by WPManageNinja in versions before 6.2.12. The vulnerability is exploitable remotely without authentication, with low attack complexity and requiring user interaction. The CVSS 3.1 base score is 7.1, reflecting high severity with impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially compromising user data confidentiality, integrity, and availability. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users interacting with vulnerable versions of the software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds from the vendor or limit exposure by restricting access to the affected components where feasible.