The vulnerability allows unauthenticated attackers to submit JavaScript payloads via the public AJAX action fluentform_step_form_save_data. The injected code is stored with the form draft data and executed whenever an administrator views a partial form entry, enabling client‑side code execution in privileged sessions.

Fluent Forms Pro Add On Pack for WordPress, versions up through 6.1.17, is affected. The draft form submission endpoint lacks authentication or nonce verification, making all versions in this range vulnerable.

The CVSS base score of 7.2 indicates high severity. The EPSS score of less than 1% suggests a low current likelihood of exploitation, and the issue is not present in the KEV catalog. Exploitation is straightforward: an attacker submits a malicious payload through the accessible AJAX endpoint, which is then stored and rendered unescaped in the admin view, leading to XSS in the administrator's browser. The lack of authentication significantly lowers the barrier to attack, but the low EPSS indicates that active exploitation remains limited.