The vulnerability is an improper neutralization of user input that allows an attacker to inject malicious scripts into the web page generated by the eForm - WordPress Form Builder plugin. A successful exploitation would enable the attacker to execute arbitrary client‑side code in the browser of any user who views the crafted page, potentially leading to session hijacking, credential theft, or defacement of the site. The weakness is a classic input‑validation flaw, classified as CWE‑79.

All installations of WPQuark eForm - WordPress Form Builder with a version earlier than 4.19.1 are affected. This includes every WordPress site that has the plugin active until that update is applied.

The CVSS score of 7.1 indicates moderate severity, while the EPSS of less than 1% suggests a very low current exploitation probability in the wild. The vulnerability can be exploited via a reflected XSS attack vector, requiring only that an attacker convince a user (ideally an administrator or visitor with sensitive privileges) to click a crafted link or follow an embedded URL. No elevated privileges or additional system compromise is necessary for execution.