The vulnerability is a Cross‑Site Request Forgery flaw that lets an attacker cause the Doppler Forms plugin to accept and persist malicious JavaScript. The stored payload can then be executed by any visitor to the infected pages, providing a persistent injection that can steal session cookies, deface content, or launch further attacks on the site. The weakness is identified as CWE‑352, which denotes the absence of proper anti‑CSRF validation.

The flaw affects all WordPress Doppler Forms installations from the earliest available release through version 2.5.1. Users of the plugin, regardless of their WordPress configuration, are potentially impacted until they upgrade to a fixed version.

The CVSS score of 7.1 gives the flaw a moderate‑to‑high severity. The EPSS score of less than 1 % indicates that, as of now, the likelihood of real‑world exploitation appears low, and the vulnerability is not yet highlighted in the CISA KEV catalog. However, because the defect is a CSRF‑enabled stored XSS, an attacker only needs to trick a victim into clicking a crafted link or rendering a malicious page that submits the request. Once the payload is recorded, any visitor to the site will be exposed, so the potential impact is wide‑ranging despite the current low exploitation probability.