The vulnerability is an improper control of code generation flaw that allows an attacker to inject and execute arbitrary code through the FluentForm plugin’s shortcode handling. The flaw introduces a code‑injection path that could lead to server‑side script execution and compromise the confidentiality, integrity, or availability of the web application. The CVSS score of 5.3 indicates a moderate severity with potential for significant impact if exploited.

The flaw affects the Shahjahan Jewel FluentForm plugin from earliest release through version 6.1.11 inclusive. Any WordPress site using FluentForm within this version range is vulnerable. No other products or versions are listed.

The EPSS score of less than 1% suggests a low probability of enterprise‑wide exploitation, and the vulnerability is not listed in CISA KEV. Attackers would need to supply a malicious shortcode or form input that contains exploitable code; the exact attack vector is not detailed in the description but is logically inferred from the injection nature of the flaw. The moderate CVSS emphasises that, while not high severity, the impact could be grave if an attacker succeeds.