A reflected cross-site scripting (XSS) vulnerability in Docuform's dfm-menu_orderopt component may allow attackers to execute malicious scripts in a user's browser session.

This is a reflected XSS vulnerability requiring authenticated, low-privilege access and user interaction (UI:R) to execute. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) indicates that successful exploitation can lead to total impact on confidentiality and integrity.

An attacker could leverage this XSS flaw to hijack user sessions, steal session cookies, or perform unauthorized actions on behalf of an authenticated administrator or user. With a CVSS score of 7.3, this vulnerability represents a significant risk to the integrity of the web application and its users.

Immediate Action: Contact Docuform or review official product documentation to identify the patched version of the dfm-menu_orderopt component.

Proactive Monitoring: Monitor web application logs for suspicious URL parameters containing script tags or encoded malicious payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured XSS protection rules to filter and block malicious input at the edge.

Public Exploit Available: No confirmed public exploit.

Security teams should verify the version of the affected component currently in use and coordinate with the vendor to obtain the necessary security updates. Until a patch is applied, ensure that web application security headers (e.g., CSP) are strictly configured to mitigate the impact of potential XSS attacks.