The vulnerability is a stored XSS flaw in the Quiz feature of MetForm Pro. Unsanitized input is saved and later rendered without proper escaping, allowing an attacker to inject arbitrary JavaScript. The injected script runs whenever a victim visits an affected page, potentially enabling cookie theft, session hijacking, defacement, or other malicious actions. The weakness is classified as CWE‑79, affecting confidentiality, integrity, and availability of the site.

All releases of the MetForm Pro WordPress plugin up to and including version 3.9.6, distributed by wpmet.

The CVSS score of 7.2 indicates moderate severity, while the EPSS score of less than 1 % shows a very low probability of current exploitation. The vulnerability is not listed by CISA as a Known Exploited Vulnerability. Attackers can exploit the flaw without authentication by submitting forged quiz data; the stored payload is executed on subsequent page loads, demonstrating the potential for widespread impact if the plugin is active on a site.