The vulnerability lies in the way the Database for Contact Form 7, WPforms, and Elementor forms plugin handles the input parameter used in its admin pages. The plugin fails to sanitize and escape this parameter before echoing it back, which can allow an attacker to inject JavaScript that executes in the browser context of users with administrative privileges. This type of vulnerability, known as Reflected XSS, permits manipulation of the user interface, credential theft, or redirection to malicious sites for users who have high‑level access to the site. The depiction of the flaw in the plugin’s code is that the value of the form identifier is directly written to the output without proper escaping.

All installations of the Database for Contact Form 7, WPforms, and Elementor forms WordPress plugin that are running before version 1.5.3 are affected. Administrators and other empowered users interacting with the plugin’s administrative pages are at risk. No specific vendor or product names are listed beyond the plugin itself, and no detailed version range is supplied except for the 1.5.3 cutoff.

The EPSS score is reported as less than 1%, indicating a very low probability of exploitation observed or predicted at this time, and the vulnerability is not catalogued in the CISA KEV list. Nevertheless, because the impact is confined to privileged administrators, the potential damage from a successful attack could be severe, enabling full control over the site. The flaw can be exploited by crafting a URL or form that includes malicious JavaScript in the form_id parameter and delivering it to a logged‑in administrator who then views the injected content in the admin interface.