The Forms WordPress plugin before version 3.0.2 does not sanitize or escape data that is stored from form submissions. Consequently an unauthenticated attacker can submit a form containing arbitrary JavaScript. When any administrator reviews the stored submission on the admin submissions screen, that script executes in the administrator’s browser, allowing the attacker to run code with the privileges of the admin user.

Any WordPress site that uses the Forms plugin and runs a version older than 3.0.2 is affected. No other components are implicated.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score is below 1%, indicating a low current probability of exploitation. The attack vector is uncomplicated – an unauthenticated user can craft and submit a malicious form – and because the flaw lies in the stored data path, the injected script runs automatically whenever an administrator views the submissions screen. The vulnerability is not listed in the CISA KEV catalog, but its potential to execute code in an administrator’s browser makes it a significant risk for sites that rely on the plugin for form handling.