A flaw in the TYPO3 Fluid‑Form extension allows an attacker to submit arbitrary values through a web form; these values are inserted into an HTML summary email without escaping. The resulting email, which is then displayed to the recipient, can contain malicious HTML scripts, leading to client‑side code execution or content spoofing. While the immediate impact is limited to the email recipient, the flaw still enables cross‑site scripting on the recipient’s browser and could be leveraged for phishing or credential theft. This weakness is classified as CWE‑79.

The vulnerability exists in the TYPO3 extension named ‘TYPO3 Fluid‑Form by coding.ms’. Any site using this extension in an unpatched state is affected; specific version information is not supplied by the CNA, so all releases of the extension must be checked for remediation.

The CVSS score of 5.3 places this issue in the medium severity range. EPSS indicates a very low probability of exploitation, yet the attack requires only an unauthenticated web interaction with the form, which is widely available. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by submitting malicious input via the form; the email is then delivered to and rendered by the recipient’s mail client or browser, where the injected script executes.