The vulnerability is an improper neutralization of input during web page generation that allows stored cross‑site scripting in the Forminator plugin. Malicious scripts submitted through a form can be persisted and later injected into any page that displays the form contents, potentially hijacking user sessions, stealing credentials, or defacing the site.

WPMU DEV’s Forminator WordPress plugin, versions from the earliest release through 1.58.3, is affected. Sites running any of those releases must verify the plugin version and whether Forminator has been upgraded.

The CVSS score of 6.5 indicates moderate severity. With stored XSS, an attacker who can submit content to a form or modify form data can achieve client‑side code execution. The exploit requires the ability to interact with the form interface, which may be available to administrators, editors, or even anonymous users depending on the site’s configuration. EPSS data is not available; the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation at this time.