CVE-2026-97301 is a CWE-79 cross-site scripting vulnerability in Cool Plugins Cool Formkit Lite versions <= 2.7.8. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with low privileges and requiring user interaction to potentially execute arbitrary code in the context of the victim's browser. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low complexity, partial privileges, required user interaction, scope change, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to data disclosure, modification, or denial of service. The vulnerability affects confidentiality, integrity, and availability to a limited extent. No known exploits are reported in the wild at this time.

No official patch or remediation guidance is currently available. Users should monitor vendor advisories for updates. Until a fix is released, limiting user privileges and exercising caution with untrusted input may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.