The Vikas Ratudi VPSUForm plugin version 3.1.14 and earlier suffers from an improper neutralization of input during web page generation, allowing an attacker to embed malicious scripts that are stored in the database and later served to unsuspecting users. The stored XSS flaw can lead to theft of session cookies, defacement of the site, or unauthorized actions performed on behalf of users. The weakness is identified as a typical input validation flaw (CWE‑79).

WordPress sites running the VPSUForm contact‑form plugin version 3.1.14 or older are affected. This includes any deployment of the Vikas Ratudi Lifetime Free Drag & Drop Contact Form Builder for WordPress, as it uses the same plugin code base. No specific customer or hosting environment is singled out, but any WordPress installation that has installed or upgraded the plugin to the mentioned versions is at risk.

The CVSS score of 5.9 indicates moderate risk. The EPSS score of less than 1% shows that the exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog, meaning no known large‑scale exploitation currently exists. The likely attack vector is through the form fields that echo back user input; an attacker could submit a script payload that is stored and later delivered to authenticated or unauthenticated users when the form data is displayed. In practice, the impact is limited to the scope of the site because the script runs in the victim’s browser context, but it can be used for credential theft and session hijacking.