Improper neutralization of user input during web page generation allows an attacker to store malicious JavaScript within the HTML Forms plugin. When a visitor loads a page containing the stored payload, the script executes in that visitor’s browser, potentially exposing session data, credentials, or other sensitive information, and enabling downstream attacks such as session hijacking or defacement.

WordPress sites that have installed Link Software LLC’s HTML Forms plugin up to and including version 1.5.2. Any instance of that plugin within this version range is impacted; later releases beyond 1.5.2 are not affected by the reported flaw.

The CGVS score of 6.5 places the vulnerability in the moderate severity category. The EPSS score of less than 1% indicates a low current exploitation probability, and the flaw is not listed in CISA’s KEV catalogue. The likely attack vector involves a stored XSS payload submitted through the plugin’s form entry interface; an attacker must control the submission data but does not require elevated site privileges. If the payload is accepted and displayed, it runs in the context of any visitor who views the affected page.