The WP Cost Estimation & Payment Forms Builder plugin is vulnerable to stored cross‑site scripting through the customerInfos parameter. Unsanitized input is stored and later rendered without proper escaping, allowing an attacker to inject arbitrary JavaScript. When a user opens an affected page, the script runs in the victim’s browser, potentially hijacking sessions, defacing content, or redirecting to malicious sites. The weakness is a classic input‑validation and output‑encoding flaw identified as CWE‑79.

All WordPress installations running loopus WP Cost Estimation & Payment Forms Builder up to and including version 10.5.97 are affected. Any site that has not upgraded past 10.5.97 is vulnerable.

The CVSS score of 7.2 classifies the issue as high severity, while the EPSS score of less than 1% indicates low exploitation probability, but the vulnerability is not listed in CISA’s KEV catalog. Attackers need no authentication and can exploit the vulnerability via publicly reachable forms that accept the customerInfos parameter. Based on the description, it is inferred that the attack vector is through the public web interface injecting the customerInfos parameter. An attacker that injects malicious content will cause any user who views the affected page to execute the injected script.