The HTML Forms – Simple WordPress Forms Plugin contains a stored cross‑site scripting flaw that originates from insufficient input sanitization and output escaping in the admin settings interface. An attacker who is already authenticated with administrator‑level or higher privileges can inject arbitrary JavaScript into the plugin configuration, which then persists and executes whenever a site visitor loads the affected page. This can lead to session hijacking, credential theft, defacement, or other client‑side attacks against users of the site.

This vulnerability affects installations of the LinkSoftware HTML Forms – Simple WordPress Forms Plugin for WordPress version 1.5.5 and earlier, specifically on multi‑site WordPress networks where the unfiltered_html capability is disabled. Any site running these versions on a multi‑site setup is susceptible if an attacker has administrative access.

The flaw has a CVSS score of 4.4, indicating a low to moderate severity, and an EPSS score of less than 1 %, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires administrative privileges and a multi‑site environment with unfiltered_html disabled, making the attack vector authenticated and limited. Nevertheless, the impact on end‑user browsers can be significant, and the low exploit likelihood does not mitigate the need for remediation.