The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to a stored cross‑site scripting flaw (CWE‑79) because it accepts SVG file uploads through an unauthenticated AJAX endpoint without validating the file content. An attacker can craft an SVG containing malicious JavaScript and upload it; when an administrative user later views the file in the WordPress admin interface, the script executes within the administrator's browser context. This mechanism can elevate the attacker’s privileges and compromise the entire site.

All versions of the Flo Forms – Easy Drag & Drop Form Builder plugin up to and including version 1.0.43 are affected. The vulnerability resides in the plugin’s handling of file uploads and the associated administrative submission endpoint.

The CVSS score is 7.1, indicating the vulnerability has medium to high severity. The EPSS score is below 1 %, showing a very low probability of exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, if exploited the impact is severe because an unauthenticated attacker can upload code that executes when an administrator views the file, potentially resulting in full site compromise. The likely attack vector is an unauthenticated AJAX request to the plugin’s endpoint and the opportunity for an admin to view the uploaded SVG. No special network access is required beyond internet connectivity.