This vulnerability (CVE-2026-66643) is a CWE-79 Cross-Site Scripting (XSS) flaw in the wronganswersonly Wufoo Shortcode plugin, affecting versions up to and including 1.55. The issue arises from improper input neutralization during web page generation, which can lead to script injection. The CVSS 3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability. No known exploits are reported in the wild and no vendor-provided patch or official remediation is currently documented.

Successful exploitation could allow an attacker with low privileges and requiring user interaction to execute arbitrary scripts in the context of the affected application, potentially leading to partial confidentiality, integrity, and availability impacts. This could result in unauthorized actions or data exposure within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin or disabling it if feasible. Monitor vendor channels for updates and apply patches promptly once released.