Improper neutralization of user input during web page generation allows an attacker to inject and store malicious JavaScript that executes in the browsers of any visitor who loads the affected content. This stored XSS can be used to steal session cookies, deface the site, or redirect users to phishing sites, thereby compromising confidentiality, integrity, and potentially availability of the web application.

The vulnerability affects the WordPress plugin Adrian Tobey FormLift for Infusionsoft Web Forms, versions from the earliest release through version 7.5.19. WordPress sites that use this plugin and accept untrusted form submissions are impacted.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve sending malicious input via any form field that the plugin processes and stores, such that the malicious script is later rendered in the web page for all users. Successful exploitation requires the ability to submit data to the form and a trust relationship where site visitors view the stored output.