The HTML Forms – Simple WordPress Forms Plugin is vulnerable to an unauthenticated stored cross‑site scripting flaw caused by insufficient sanitization of file upload field metadata before it is displayed in the WordPress admin dashboard. An attacker can inject arbitrary web scripts that are executed every time an administrator visits the form submissions page, potentially allowing session hijacking, credential theft, or other malicious actions that compromise the confidentiality and integrity of the site. The weakness is a classic input validation error (CWE‑79).

All installations of the HTML Forms – Simple WordPress Forms Plugin with versions 1.6.0 or earlier, which are common on WordPress sites. The vulnerability applies to the plugin’s handling of uploaded file metadata and is present in every release up to and including 1.6.0.

The CVSS score of 6.1 indicates moderate severity, while the EPSS < 1% score implies a low probability of exploitation at this time. The flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The attack vector is unauthenticated, enabling any web visitor to craft malicious file metadata that is stored and later rendered in an administrator’s browser. Exploitation requires that the attacker can submit a file via the plugin’s upload interface, after which the malicious script will load whenever an admin accesses the submissions page.