The Forms Bridge – Infinite integrations plugin for WordPress contains a stored cross‑site scripting flaw embedded in the 'id' attribute of the 'financoop_campaign' shortcode. Unsanitized input permits any authenticated Contributor or higher to inject arbitrary JavaScript into the plugin’s storage. Once injected, the code executes in every visitor’s browser when they request a page containing the shortcode, potentially enabling cookie theft, session hijacking, and defacement. This deficit corresponds to CWE‑79.

The vulnerability affects all installations of the Forms Bridge – Infinite integrations plugin by codeccoop running WordPress, with affected releases up through 4.2.5. Any site that has not yet updated beyond this version and has users granted Contributor or higher privileges is exposed. The issue is limited to the plugin component and does not impact core WordPress or other plugins directly.

The flaw carries a medium CVSS score of 6.4 and an EPSS value of less than 1 percent, indicating it is not a top‑priority exploit but still a valid attack vector. Since exploitation requires authenticated access at Contributor level or above, an attacker must first compromise an account with sufficient privileges or exploit social engineering to obtain one. Once the payload is in place, every page visitor executing the shortcode becomes a victim. The vulnerability is not listed in the CISA KEV catalog, further suggesting it is not widely targeted yet.