The Cool FormKit Lite plug‑in lets attackers with contributor‑level access inject arbitrary JavaScript into form pages. By setting the _elementor_data.form_fields[].custom_id field, insufficient sanitization is bypassed, enabling a stored DOM‑based XSS that runs whenever a visitor loads a page containing the affected form. This flaw can be used to deface content, steal credentials, or hijack user sessions.

The vulnerability exists in the Cool FormKit Lite – Advanced Form Builder for Elementor plug‑in for WordPress, affecting all releases up to and including version 2.7.9. WordPress sites that have installed any of those versions and have a user with contributor or higher privileges are susceptible.

The CVSS v3 base score of 6.4 indicates a moderate risk. Attackers must authenticate within WordPress with contributor or higher access, which limits the threat surface but still allows malicious form creation on sites they control. Because the exploitation vector requires direct manipulation of the form configuration, the vulnerability is not trivially exploitable by remote unauthenticated users. The EPSS score is not available and the flaw is not yet listed in the CISA KEV catalog, but the potential impact of arbitrary script execution on site visitors warrants immediate attention.