The Cool Formkit Lite WordPress plugin contains an improper neutralization of script‑related HTML tags that allows attackers to inject arbitrary JavaScript into a page. This basic cross‑site scripting flaw can be triggered when user input is not properly sanitized before being rendered, potentially enabling credential theft, session hijacking, or defacement of the site. The vulnerability is identified as CWE‑80 and is considered a moderate severity issue with a CVSS score of 5.3.

All installations of the Cool Plugins Cool Formkit Lite WordPress plugin up to and including version 2.7.10 are affected. The issue originates in the extensions‑for‑elementor‑form module and impacts any WordPress site that uses this plug‑in without relying on newer versions.

The CVSS score indicates a moderate risk level; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers can induce the vulnerability by supplying crafted input via the plugin’s form fields in a browser context. If the plugin is engaged and a user views the resulting page, the injected script executes with the privileges of the visitor’s browser session.