CVE-2026-66616 is an unauthenticated Cross Site Scripting (XSS) vulnerability in Form Maker by 10Web affecting versions up to 1.15.46. The vulnerability allows remote attackers to inject malicious scripts that execute in the context of the victim's browser, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no privileges, but requires user interaction. No known exploits in the wild have been reported. No patch or remediation information is currently provided.

The vulnerability can lead to execution of arbitrary scripts in the context of users interacting with the vulnerable Form Maker plugin, potentially resulting in limited data disclosure, manipulation, or disruption of availability. Because the attack requires user interaction, the impact is somewhat mitigated. The vulnerability affects confidentiality, integrity, and availability to a limited degree as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected plugin or disabling it if feasible. Monitor vendor channels for updates or patches addressing this vulnerability.