The WPForms "Easy Form Builder" plugin for WordPress contains a stored XSS flaw that lets authenticated users with Contributor privileges or higher inject arbitrary JavaScript through the start_timestamp parameter. Because the value is stored with the form and served to visitors without proper filtering, any user who opens a page containing that form will have the malicious script executed in their browser. This can lead to session hijacking, defacement, or the delivery of malware to site visitors. The weakness arises from insufficient input sanitization and a lack of output escaping, and is classified as a classic Cross‑Site Scripting fault.

All WordPress sites that have installed the WPForms Lite plugin up to and including version 1.9.5 are affected. The plugin is distributed by smub under the name "WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More". Any installation that has not upgraded beyond 1.9.5 must assess whether the start_timestamp parameter has been used in stored form data.

The CVSS base score of 5.4 indicates moderate severity. The EPSS score is listed as less than 1%, so exploitation in the wild is unlikely at present. The flaw requires only Contributor‑level authentication, making compromise accessible to a wide set of users who normally have content‑authoring rights. Because it is a stored XSS, the attack vector is an authenticated interaction with the plugin’s form editor where the malicious payload can be inserted into the start_timestamp field. The vulnerability is not currently listed in the CISA KEV catalog, so it is not known to be actively used by major threat actors, but any successful exploitation would affect all visitors who load the compromised form pages.