This vulnerability is an unauthenticated XSS flaw in the CformsII WordPress plugin that allows an attacker to inject arbitrary scripts into form inputs. The injected code can run in the browsers of anyone who views the affected page, enabling defacement, theft of session cookies, or redirection to malicious sites. The weakness is a classic unsanitized input that violates confidentiality, integrity, and availability (via user experience degradation).

The flaw affects the WordPress plugin CformsII (vendor bgermann), in all releases up to and including version 15.1.3. Versions 15.1.4 and later contain the mitigation.

The CVSS score of 7.1 classifies this as high severity. The EPSS score is indicated as less than 1%, suggesting a very low but non–zero likelihood of exploitation at this time. It has not been listed in the CISA KEV catalog. The most probable attack vector is an unauthenticated attacker delivering malicious data via any publicly accessible form field, after which the script executes in a visitor’s browser.