Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions. (CVE-2026-66598)

CVE-2026-66598 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting B2BKing Premium versions up to 5.6.07. The vulnerability allows remote attackers to execute arbitrary scripts in the context of the affected application without requiring authentication. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. No patch or remediation information is provided in the available data.

Successful exploitation of this vulnerability could allow attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other malicious actions affecting confidentiality, integrity, and availability of the application and its users. Since the vulnerability is unauthenticated, it can be exploited by any remote attacker without credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying any recommended temporary mitigations from the vendor or restricting access to affected components if possible.