The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to store malicious scripts via the Zigaform Form Builder Lite plugin. A stored XSS can execute in any visitor’s browser when the stored data is displayed, enabling session hijacking, defacement, or phishing attacks. The weakness corresponds to CWE‑79, underscoring the lack of input validation for user‑submitted content.

WordPress installations using the Zigaform Form Builder Lite plugin version 7.4.2 or earlier are affected. The plugin was released by Softdiscover, and the vulnerability covers all versions up to 7.4.2, including any custom deployments of the same code base.

The CVSS score of 7.1 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not yet listed in CISA’s KEV catalog. The likely attack path involves user interaction with the plugin’s form input fields, where an attacker can inject JavaScript that is later rendered for other visitors. In the absence of authentication requirements, the vulnerability could be triggered by any user who can submit content through the plugin, making it a potentially wide‑spread risk.