The vulnerability allows an attacker to store malicious scripts via the bf_post_type (and buddyforms_form_content) parameter in public forms. A user who views a page containing the injected contents will trigger the script, enabling potential theft of session data, defacement, or further attacks. It is a CWE-79 input validation and output escaping flaw. The flaw can be exploited without authentication, affecting sites where at least one BuddyForms form accepts public submissions.

BuddyForms plugin for WordPress in any version up to and including 2.10.5. The issue requires a public form that includes a nonce and an active widgetized sidebar to deliver the malicious content.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation remains uncertain, but the flaw is not listed in the CISA KEV catalog. Attackers would need to exploit a public form and a widgetized sidebar; once the script runs it executes with the privileges of the visiting user. The vulnerability is exploitable without authentication but requires visible public submission capability and active sidebars.