An unauthenticated Cross‑Site Scripting vulnerability exists in the WordPress Form Block plugin up to and including version 1.8.1. The flaw allows attackers to inject arbitrary scripts into pages that contain the plugin’s form elements. If the malicious payload is not properly sanitized, the script will run in the browsers of any user who views the affected page.

The defect affects any site that installs the WordPress Form Block plugin version 1.8.1 or earlier from the vendor epiphyt. No other WordPress components are directly mentioned as impacted.

The CVSS score of 7.1 classifies the vulnerability as high severity. Because the flaw is unauthenticated, any visitor to the site can exploit it by submitting a crafted form or loading a page that contains the compromised form element; no additional conditions or privileges are required. The EPSS score is 0.00237, and the vulnerability has not been listed in the CISA KEV catalog, indicating no publicly known widespread exploitation yet. The likely attack vector involves an attacker embedding malicious JavaScript in form inputs that are rendered unsafely on the front‑end. Based on the description, it is inferred that attackers could achieve script execution in visitors’ browsers.