The vulnerability resides in the "Form Header" field of the WordPress Inquiry Form to Posts or Pages plugin version 1.0 and earlier. Insufficient sanitization when saving the field and insufficient escaping when rendering it allows an authenticated administrator to inject arbitrary JavaScript. The stored script will run whenever an administrator visits the plugin’s settings page or when any visitor loads a page containing the [inquiry_form] shortcode, potentially enabling session hijacking, defacement, or malicious redirection.

Any WordPress site using the Inquiry Form to Posts or Pages plugin version 1.0 or older is affected regardless of the WordPress core version. Administrators with control over the plugin settings can introduce the flaw.

With a CVSS score of 4.4 this is a moderate‑severity issue that requires authenticated administrator access. No EPSS data is available and the flaw is not listed in the CISA KEV catalog, indicating no confirmed exploitation. The attack path involves logging into the WordPress admin area, entering malicious payloads into the "Form Header" field, and then having the script execute on future page renders for all site visitors.