The Responsive Contact Form Builder & Lead Generation Plugin for WordPress is vulnerable to stored cross‑site scripting due to insufficient sanitization in the lfb_lead_sanitize() function and an overly permissive wp_kses() filter that allows onclick attributes on anchor tags. This flaw permits unauthenticated attackers to submit malicious content via a form field, which is then stored in the database. When a site administrator later views the lead entries in the WordPress dashboard, the stored script is rendered and executed in the admin browser context. The vulnerability is a classic input validation/sanitization defect identified as CWE‑79.

All WordPress installations that have the themehunk Lead Form Builder & Contact Form plugin version 2.0.1 or earlier are affected. The weakness spans the entire plugin codebase for these versions; any site that accepts form submissions using this plugin is susceptible to the stored XSS vector.

The CVSS score of 7.2 indicates a high severity for confidentiality, integrity, and availability of the administrative session. The EPSS score of less than 1 % suggests a relatively low likelihood of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs an unauthenticated POST to the plugin’s form endpoint; no authentication or privileged access is required. When the stored payload is viewed by an administrator, it executes in their browser, potentially stealing session cookies, defacing the dashboard, or executing arbitrary client‑side code.