WPForms Pro contains a stored cross‑site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into Single Line Text and Paragraph Text fields. The flaw stems from the plugin's wp_kses_allowed_html filter expanding WordPress's standard allowlist to include an iframe tag with a data‑src attribute, which bypasses URI filtering. When a JavaScript URI is stored in data‑src, it eventually becomes a live src attribute via the bundled admin script view‑entry.min.js, enabling arbitrary script execution for any user who views a form submission page.

The vulnerability exists in all WPForms Pro releases up to and including version 2.0.0.2. Users running these versions on a WordPress site with forms that incorporate Single Line Text or Paragraph Text fields are affected.

With a CVSS score of 7.2, this is a medium‑to‑high severity issue that can be exploited without authentication. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the path requires only submit a malicious form entry and any visitor to the entry page will execute the injected script, potentially compromising user credentials, session tokens, or defacing the site.