The vulnerability is an instance of Improper Neutralization of Input During Web Page Generation (CWE‑79) that permits an attacker to store malicious script payloads in content handled by the Doppler Forms plugin. The stored payload is rendered without escaping when the page is accessed, causing the script to execute in the browser context of anyone who views the affected page. This can enable client‑side attacks that compromise the integrity or confidentiality of the user session.

The affected product is the Doppler Forms plugin for WordPress, released by the vendor Doppler Forms (fromdoppler). Versions from the earliest release through version 2.5.1 are vulnerable. Sites that have not updated to 2.5.2 or later and that allow untrusted users to submit data via Doppler Forms are at risk.

The CVSS score of 6.5 reflects a moderate severity. The EPSS score is below 1%, suggesting that active exploitation is currently rare. The vulnerability is not in the CISA KEV catalog. Exploitation requires an attacker to submit a form entry that includes a malicious script; the payload is stored by the plugin and rendered unescaped on subsequent page loads. Attackers do not require authentication. The risk level is therefore medium to high for sites that accept untrusted form submissions without additional safeguards.