The vulnerability is a stored Cross‑Site Scripting flaw caused by improper neutralization of user input during web page generation in the Mollie Forms WordPress plugin. Malicious script can be entered via the plugin’s form fields, stored in the database, and rendered when the page is displayed, causing the script to execute in visitors’ browsers. Based on the description, it is inferred that such scripts could steal session cookies or perform other client‑side actions.

The issue affects the Mollie Forms plugin developed by Nick van Wobbie for WordPress. Any installation of the plugin at version 2.7.12 or earlier is vulnerable, regardless of the WordPress core version, as the flaw resides in the plugin code itself.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that the probability of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the plugin’s form inputs, which an attacker can use to inject malicious code. It is inferred that the attack would require crafting a malicious form submission and that the malicious payload would execute when the stored content is rendered to users.