The vulnerability is a stored cross‑site scripting flaw exposed through the Simple Form autocomplete lookup label in WP Data Access. Insufficient output escaping allows an authenticated user at the Subscriber level or higher to inject arbitrary scripts that are saved as part of a lookup row. When any user, including administrators editing a related record, loads a page containing the injected label, the malicious code executes in the context of that user, potentially allowing session hijacking, credential theft, or defacement.

This issue affects the WordPress plugin WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps, specifically versions ranging from the initial release up to and including 5.5.89. The problem originates in the file WPDA_Simple_Form_Item_Autocomplete::show_item() which echoes the lookup value without proper escaping.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation has been reported. Attack requires authentication with at least Subscriber privileges; the attacker must edit a legacy form to insert malicious markup. Once the payload is stored, it is triggered automatically on any page that renders the lookup label, exposing higher‑privileged users to the risk of script execution.