Form Vibes EUVD-2026-48205

Exploitation requires no authentication (PR:N) and is network-reachable (AV:N) against Form Vibes <= 1.5.2, but it is gated by user interaction (UI:R): a victim must open an attacker-crafted link or view attacker-controlled data rendered by the plugin (for example the Form Vibes submission-data views that display captured form fields). The concrete prerequisite is that the plugin renders attacker-influenced input - a form field value or request parameter - into an HTML page without proper output encoding (CWE-79). Limiting factors: the payload only executes when a user actually loads the affected page, impact is client-side (C:L/I:L/A:L, no direct server code execution), and sites not running the vulnerable Form Vibes version or not exposing the affected rendering path are unaffected. No non-default configuration is documented as required in the provided data.

The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges, but requiring user interaction, with a scope change and Low impact across confidentiality, integrity, and availability - a profile typical of XSS rather than direct server compromise. No EPSS score was provided in the input, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC was referenced, so this should be treated as no public exploit identified at time of analysis. The practical limiting factor is UI:R - an attacker must lure a user to a malicious link or trigger a rendered malicious submission - which lowers real-world urgency compared to a zero-interaction RCE. Net assessment: a legitimately High-scored client-side flaw worth patching on normal cycles, but not an emergency absent exploitation signals; note the input contains no EPSS/SSVC data, so those decision inputs could not be weighed.

An attacker crafts a URL or a form submission containing a JavaScript payload targeting a Form Vibes-rendered field or parameter and delivers it to a victim (e.g., a site administrator viewing captured submissions, or a user following a crafted link). When the unsanitized data is rendered, the script executes in the victim's browser session, enabling actions such as session/cookie theft, admin UI manipulation, or forced requests. No public POC was referenced, and success depends on the required user interaction (UI:R) and low attack complexity (AC:L).