The vulnerability is an improper neutralization of input that allows an attacker to store malicious JavaScript in form fields. Once stored, the script is served to any user who views the form or its submissions, enabling session hijacking, credential theft, defacement or other client‑side attacks. The weakness is a classic stored XSS flaw based on CWE-79.

It affects the Ninja Forms WordPress plugin, specifically every release from the first version up to and including 3.15.5, developed by Kevin Stover. WordPress sites that have the plugin installed in any of those versions are vulnerable.

The CVSS score of 7.1 indicates a moderate to high severity. EPSS is not available, so the likelihood of exploitation cannot be quantified from the data, but the lack of a KEV listing does not diminish the risk. The attack vector is inferred to be through the plugin’s public or administrative form submission interface, and no authentication requirement is mentioned, so it is likely that anyone can submit malicious input.