The SpiceForms Form Builder plugin for WordPress is vulnerable to stored XSS through the 'spiceforms' shortcode. An authenticated user with contributor-level rights can supply unsanitized attributes that are later stored and rendered on any page using the shortcode. This allows the injection of arbitrary JavaScript that will execute in the browsers of all visitors to the page, potentially leading to session hijacking, defacement, or the delivery of malicious content. The weakness is a classic input‑validation flaw (CWE‑79).

Aankit’s SpiceForms Form Builder plugin, distributed via the WordPress plugin repository, is affected in all releases up to and including 1.0. Administrators should check their WordPress installations for this plugin and verify the installed version. The vulnerability is present when the plugin is active; disabling it removes the risk.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1 % suggests a low likelihood that attackers are currently exploiting the flaw in the wild, and it is not listed in the CISA KEV catalog. The attack path requires authenticated access with at least contributor privileges and the ability to add or edit shortcode content; passive browsing does not trigger the flaw. Nonetheless, the potential damage to user sessions and site reputation warrants timely remediation.