An improper neutralization of input during web page generation in the ActiveCampaign WordPress plugin, from the earliest released version up through 8.1.16, allows stored cross‑site scripting. The vulnerability arises when user‑supplied data is saved and later rendered without proper sanitization, permitting malicious scripts to be embedded in the site’s content.

The affected product is the ActiveCampaign WordPress subscription‑forms plugin, in all versions up to and including 8.1.16. All installations that have not upgraded beyond 8.1.16 are potentially vulnerable.

The CVSS score of 5.9 indicates a medium‑severity risk, while the EPSS score of less than 1% suggests that exploitation probability is currently very low. The issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw by submitting malicious input through the subscription forms, with no privileged access or external network exploitation required. Successful exploitation would cause arbitrary script execution in the context of any user who views the rendered content, potentially enabling various malicious actions.