The flaw resides in the WordPress Contact Form to Email plugin version 1.3.24, where form names are stored in the database without sanitization, enabling an attacker who is authenticated to the WordPress site to embed JavaScript code in a form name. When any other logged‑in user accesses the form management page, the script executes in that user’s browser context, enabling theft of session cookies or other credential leakage. This is a classic stored XSS vulnerability identified as CWE‑79, and it provides an attacker with the same level of access as the victim user.

The vulnerability affects installations of the Form2Email Contact Form to Email plugin for WordPress, specifically version 1.3.24. All sites that have not applied the 1.3.25 or later patch and still employ that plugin are at risk.

With a CVSS score of 5.1, the vulnerability falls into the moderate severity range. The exploit requires an attacker to be an authenticated WordPress user, but the attack is trivial once authenticated, as the attacker simply creates a malicious form name. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Despite the moderate score, the potential for credential theft makes the risk meaningful for sites that rely on the plugin and have many administrators or staff users.