The vulnerability is a reflected cross‑site scripting flaw in WordPress Contact Form Builder 1.6.1. It is classified as CWE‑79 and allows attackers to inject JavaScript by supplying a malicious value in the form_id request parameter. When a victim loads the generated URL, the script runs in their browser, enabling the attacker to steal session cookies, deface pages, or redirect users to phishing sites.

The affected product is wpdevart’s Contact Form Builder plugin for WordPress with the vulnerable release 1.6.1. No other vendors or versions are listed as impacted.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is not available and the vulnerability is not cataloged in CISA KEV, suggesting limited known exploitation. Attackers can exploit the flaw by accessing an unauthenticated, crafted URL targeting code_generator.php. The compromise is client‑side and requires victims to visit the malicious link; the attacker can then execute arbitrary JavaScript in those browsers.