Based on the description, this vulnerability is an improper neutralization of input during web page generation, also known as a stored cross‑site scripting flaw. Malicious code can be stored in the PDF for WPForms plugin payload and later executed in the browsers of users who view the affected content. The weakness maps to CWE‑79 and can lead to session hijacking, defacement, or phishing attacks.

add-ons.org PDF for WPForms, versions from n/a through <= 6.2.1 inclusive, are affected. All releases up to and including 6.2.1 are vulnerable until corrected in a later release.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of <1% suggests that exploitation of this flaw is currently considered unlikely, and the flaw is not listed in the CISA KEV catalog. Based on the description, the attack exploits require the attacker to inject malicious content into data that the plugin will store and later retrieve; a victim must then load the same content in a browser for code execution. Because the flaw is stored XSS, the impact depends on the privileges of the victim and the content the attacker can embed, but it can compromise confidentiality and integrity of user sessions.