The vulnerability is a Reflected Cross‑Site Scripting flaw caused by improper input neutralization in the GSheetConnector for Forminator Forms WordPress plugin. When an attacker crafts a malicious payload that is reflected back into the webpage, users who visit the affected URL can have arbitrary scripts executed in their browser. This can lead to session hijacking, credential theft, defacement, or other attacks that compromise the confidentiality, integrity, and availability of the site’s data. The weakness is classified as CWE‑79.

The flaw affects the WesternDeal GSheetConnector for Forminator Forms plugin for WordPress, impacting all releases from the earliest available version up to version 1.0.12. Site owners running any of these versions are vulnerable if the plugin remains active.

With a CVSS score of 7.1 the vulnerability is considered high severity, but the EPSS score is less than 1% and it does not appear in the CISA KEV catalog. The likely attack vector is a crafted URL or form submission that includes malicious input, which the plugin reflects without proper escaping. Successful exploitation requires user interaction (visiting the malicious link) but could be leveraged deeply via social engineering. Given the low exploitation probability, it is still recommended to remediate immediately to prevent potential widespread impact.