The Wpik WordPress Basic Ajax Form plugin for WordPress allows authenticated users with Contributor or higher privileges to store malicious JavaScript in the 'dname' field. This stored cross‑site scripting flaw results in the injected script executing within users' browsers whenever the affected page is viewed, potentially enabling credential theft, session hijacking, defacement or other malicious actions. The weakness stems from insufficient input sanitization and output escaping, a classic manifestation of CWE‑79.

The vulnerability affects the Wpik WordPress Basic Ajax Form plugin for WordPress, issued by the vendor awanhrp, in all releases up to and including version 1.0. No specific sub‑versions are listed; any installation that has not yet been updated beyond 1.0 is susceptible.

The CVSS score of 6.4 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog, meaning there is no confirmed widespread exploitation yet. An attacker must first be authenticated with Contributor or higher privileges, but once authenticated they can inject arbitrary scripts that will run in the context of any site visitor. Despite the limited access requirement, the potential impact on user sessions and site integrity makes it a material concern for site administrators.