The weForms plugin for WordPress has a Stored Cross‑Site Scripting flaw that allows an authenticated user with Subscriber‑level access or higher to inject arbitrary JavaScript into hidden form field values via the REST API entry submission endpoint. The injected scripts are stored without proper sanitization because the REST API bypasses the normal input‑cleanup logic used for frontend AJAX submissions. When an administrator later opens the form entries page, the data is rendered by Vue.js using a v‑html directive that does not escape the content, causing the script to execute in the browser context.

The flaw affects the Boldgrid:weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin in all released versions up to and including 1.6.27. Versions newer than 1.6.27 are not identified as vulnerable in the input data, so no specific version beyond that is known to be at risk.

The CVSS v3.1 base score of 6.4 indicates moderate severity, and an EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker be able to authenticate to the site with a Subscriber or higher role and submit a crafted payload to the REST API endpoint /wp‑json/weforms/v1/forms/{id}/entries/. When an administrator views the stored entries, the malicious JavaScript will run, potentially leading to theft of session cookies, defacement, or further lateral movement within the WordPress installation.