An unauthenticated Cross Site Scripting vulnerability exists in the WordPress Form Vibes – Database Manager for Forms plugin up to and including version 1.5.2. The flaw allows arbitrary JavaScript to be injected and executed in the context of the site, which could lead to data theft, defacement, or further malicious activity. The weakness is identified as a classic input‑validation flaw (CWE‑79).

WordPress installations that have the WPVibes Form Vibes – Database Manager for Forms plugin installed at any version equal to or earlier than 1.5.2. The vendor is WPVibes, and the affected product is the Form Vibes plugin.

The CVSS base score of 7.1 indicates a high impact vulnerability, while the EPSS score of less than 1% shows a very low but non‑zero probability of exploitation. The flaw is accessible to unauthenticated users, meaning any site visitor could trigger the vulnerability if the plugin renders unsanitized input. The vulnerability is not listed in the CISA KEV catalog, which suggests it has not yet been widely exploited in the field.