The vulnerability allows an attacker to inject arbitrary JavaScript into pages by manipulating the 'page_title' POST parameter. The attack relies on the {page_title} Smart Tag being inserted within an HTML attribute in the confirmation message. When an unauthenticated user clicks a crafted link, the injected script executes in the victim’s browser, potentially enabling cookie theft, session hijacking, and site defacement. This is a classic reflected XSS flaw identified as CWE-79.

The issue is present in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for all releases up to and including version 2.0.2. Administrators who have configured the confirmation message to include the {page_title} Smart Tag inside an attribute value are at risk. The threat applies to any WordPress installation that uses one of these affected plugin versions.

The CVSS score of 6.1 indicates a medium severity. No EPSS score is available, so the exploitation probability is unknown, but XSS attacks typically depend on user interaction, requiring the victim to click a malicious link. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. The attack vector is inferred to be external, relying on a crafted POST request that an attacker can trick a user into submitting. Once the victim loads the page, the malicious script runs with the privileges of the visitor, potentially compromising sensitive data or facilitating further attacks.