An DOM‑Based cross‑site scripting flaw exists in the Smart Forms plugin for WordPress versions up to 2.6.104. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject client‑side scripts into the application's DOM. When a user accesses the vulnerable form, the injected script executes within the victim’s browser, potentially enabling session hijacking, defacement, or phishing attacks. This weakness is classified as CWE‑79.

EDGARROJAS Smart Forms, the WordPress plugin named Smart Forms, is affected when deployed with version 2.6.104 or any earlier release. The vulnerability is present in all installations of the plugin that have not been upgraded past this point.

The CVSS vector assigns a 7.1 score, indicating a high‑severity bug. The EPSS score of 0.00237 indicates an exploitation probability of roughly 0.24%, suggesting a very low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. The attack likely involves injecting malicious scripts into content that the plugin renders, though specific exploitation details are not provided.