The WS Form LITE – Drag & Drop Contact Form Builder contains a flaw where the field_<id>[0][0] parameter is not properly sanitized or escaped, allowing attackers to store malicious scripts that will run whenever a page containing that data is viewed. This stored XSS vulnerability (CWE‑79) gives the attacker the ability to execute arbitrary code in the browsers of all visitors to the affected pages, potentially compromising confidentiality, integrity, or availability of the site and of the users’ data, and persists until the injected data is removed by an administrator.

Westguard’s WS Form LITE – Drag & Drop Contact Form Builder, versions up to and including 1.12.18.

The CVSS score of 7.2 classifies this as high severity, and with no authentication required, the attack vector is a web application form input. Although the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the vulnerability can be readily exploited by unauthenticated actors who submit a crafted form entry, leading to persistent cross‑site scripting that affects all users who load the page.