This vulnerability in the WordPress ez Form Calculator Premium plugin originates from improper neutralization of user input when the plugin generates the response web page. Unsanitized form field data can be reflected back into the page, allowing an attacker to inject and execute arbitrary client‑side scripts in the browser of anyone who views the affected page.

The affected product is WordPress ez Form Calculator Premium from the vendor keksdieb. All releases up to and including version 2.14.1.2 are vulnerable and therefore any WordPress installation that has this plugin enabled and accepts form submissions is at risk.

The CVSS score of 7.1 indicates a high‑to‑moderate severity. The EPSS score of less than 1% suggests the likelihood of exploitation in the wild is very low at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a reflected XSS attack triggered when a user visits a specially crafted URL containing malicious payloads in form fields; exploitation requires the victim to interact with the form or click a link.