The flaw involves improper neutralization of input when generating web pages using the Jacob Allred Infusionsoft Web Form JavaScript plugin. A malicious user can embed stored JavaScript that is later rendered for any visitor, creating a stored cross‑site scripting condition. This can lead to cookie theft, session hijacking, defacement, or other cross‑site script exploitation.

WordPress sites that have the Jacob Allred Infusionsoft Web Form JavaScript plugin installed in any version up to and including 1.1.1 are affected. The vulnerability arises from how the plugin stores form data and renders it on the front‑end without sanitizing user input.

The CVSS base score of 6.5 indicates medium severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker be able to inject malicious content into the plugin’s storage mechanism—likely through the form submission path—and that the site serve that content without filtering or encoding. The attack surface is the public web interface of the affected WordPress installation.