The Tripetto WordPress form builder plugin contains a stored cross‑site scripting (XSS) flaw that allows an attacker to inject malicious scripts into fields that are later rendered on web pages. Because the input is not properly sanitized, attackers can embed arbitrary JavaScript that will execute in the browsers of anyone who views the affected content. This vulnerability is categorized as CWE‑79 and has a CVSS score of 7.1, indicating a high‑severity risk of compromising confidentiality, integrity, and availability of the affected site through user‑agent attacks.

Any WordPress installation that has the Tripetto form builder plugin version 8.0.6 or earlier is impacted. The issue applies to every variant of the plugin, from the earliest release up to and including 8.0.6. Site owners should verify the current plugin version and consider upgrades or removal to eliminate the risk.

The EPSS score is below 1 %, suggesting that exploitation is unlikely to occur at scale, but the CVSS rating of 7.1 highlights the potential for significant damage if an attacker successfully injects code. The flaw is stored, meaning the malicious payload persists until the content is viewed, and the attack vector is through normal user interactions with the plugin’s form fields. The flaw does not appear in the CISA KEV catalog, so it may not be widely exploited yet, but the lack of a KEV listing does not mitigate the inherent risk.