The WP Cost Estimation & Payment Forms Builder plugin fails to sanitise the 'customerInfos' input before storing it. When the stored value is later rendered, the browser interprets it as executable code, allowing an attacker to inject arbitrary JavaScript that runs in the browser of any user who views the affected page. This stored XSS can lead to session hijacking, defacement, or redirection to malicious sites.

WordPress sites that have installed loopus WP Cost Estimation & Payment Forms Builder v10.5.97 or earlier are vulnerable. Any site that has not moved beyond version 10.5.97 remains at risk.

The CVSS score of 7.2 classifies the issue as high severity. The EPSS score of less than 1% indicates a low likelihood of exploitation, yet the vulnerability is not listed in CISA’s KEV catalog. Attackers need no authentication and can exploit the flaw through the publicly reachable forms that accept the 'customerInfos' parameter. Based on the description, the attack vector is inferred to be the public web interface injecting the parameter; the malicious script will execute for all users who view the affected page, compromising user sessions and site integrity.