Stored XSS weaknesses arise from improper neutralization of user input during page generation in the formafzar WordPress plugin. The flaw permits attackers to persistently inject malicious JavaScript into form submissions, enabling arbitrary script execution on visitors’ browsers. Based on the description, it is inferred that this could lead to session hijacking, credential theft, or site defacement, thereby compromising confidential information and user trust.

The vulnerability affects the WordPress formafzar فرم ساز فرم افزار plugin in all releases up to and including version 2.0, as identified by the vendor. Any site that has an affected version installed and processes form data is at risk.

The CVSS score of 6.5 places the issue in the medium severity range. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis, and the flaw is not yet listed in the CISA KEV catalog. Attackers would need to supply crafted input to the plugin’s form handling end‑points; the vulnerability is stored, meaning that it remains present after form submission and can be triggered by unauthenticated or authenticated users who visit affected pages. Despite the low EPSS, the potential impact warrants timely remediation.