The FormCraft WordPress plugin is vulnerable to stored cross‑site scripting (CWE‑79) because user‑supplied data is written to the database without adequate sanitization or escaping. The flaw specifically involves matrix field sub‑parameters that bypass the plugin’s sanitization loop and, after storage, are injected directly into page output. An attacker can craft a form submission that includes malicious JavaScript, which will be executed whenever any visitor loads the affected page, enabling script injection, defacement, or cookie theft.

All installations of the FormCraft plugin for WordPress with versions 3.9.14 and earlier are impacted. If a site uses matrix field types in its forms and has not applied any later fix, the vulnerability exists.

A CVSS score of 7.2 indicates a high severity, and the EPSS score of less than 1% suggests the likelihood of public exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector is user input through any publicly accessible form that includes matrix fields; the attacker can send crafted data, which will be stored and executed later in the DOM. The impact includes arbitrary script execution on victim browsers, potentially leading to data theft, session hijack, or defacement.