The FormCraft WordPress plugin allows users to upload SVG files without proper input sanitisation or output escaping. An unauthenticated attacker can therefore embed arbitrary JavaScript within an SVG file. When any site visitor views or downloads the SVG, the injected script executes in the victim’s browser, enabling typical XSS consequences such as session hijacking, defacement or data theft. This vulnerability is characterised as Stored XSS (CWE‑79).

The flaw exists in all FormCraft plugin releases up to and including version 3.9.11. The affected product is the FormCraft Premium WordPress Form Builder provided by Ncrafts. The plugin runs within a WordPress environment; any installation hosting the plugin and permitting SVG uploads is vulnerable.

The CVSS score of 7.2 indicates a high severity, with the EPSS score of less than 1% suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is unauthenticated file upload: an attacker simply submits an SVG via the form builder’s file upload interface; once stored, the payload will execute whenever any logged‑in or anonymous user accesses the SVG file. No special authentication or privilege is required, which widens the threat surface.