The LeadBI plugin for WordPress contains a flaw in which the 'form_id' attribute of the 'leadbi_form' shortcode is not sanitized or escaped before being stored. This allows an authenticated user with Contributor or higher privileges to insert arbitrary JavaScript that will be served to any visitor who views a page containing the malicious shortcode. The vulnerability results in a stored cross‑site scripting condition that can compromise the integrity of rendered pages for all users on the site.

All WordPress sites that have the LeadBI plugin installed from the leadbi vendor and running any version up to and including 1.7 are affected. Any installation where the plugin is active and users have Contributor or higher roles can be used to inject the malicious form_id value.

The CVSS score of 6.4 classifies this flaw as medium severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated Contributor‑level or higher account on the WordPress site and the ability to add or edit content containing the 'leadbi_form' shortcode; the injected script then executes for every visitor encountering the content.