Improper neutralization of user supplied data allows an attacker to inject arbitrary client‑side script into web pages generated by the Contact Form Builder by vcita plugin. The flaw is a DOM‑Based XSS that can be triggered by crafted form input, URLs, or other user‑controlled data that is rendered without sanitization. An attacker who succeeds could run JavaScript in the victim’s browser, potentially leading to phishing, cookie theft, or malicious activity that masquerades as the site.

The vulnerability impacts installations of the Contact Form Builder by vcita plugin, version 4.10.2 and earlier. The product is delivered by the vendor eyale‑vc under the name "Contact Form Builder by vcita".

The CVSS score of 6.5 denotes a moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation at the time of this analysis, and the vulnerability is not present in the CISA KEV catalog. Likely exploitation would involve an attacker placing malicious payloads into the form interface, which any user who loads the affected page would execute, but no higher‑privilege or remote code execution capabilities are disclosed in the CVE data.