The Repeater Fields for Elementor Forms plugin is vulnerable to stored cross‑site scripting because it fails to sanitize or escape repeater field values before rendering them. An unauthenticated attacker can submit a value that contains malicious JavaScript, which is then persisted to the database. When any user views a page that pulls that field, the script executes in the victim’s browser, allowing the attacker to steal cookies, hijack sessions, deface the site, or launch further attacks. This vulnerability directly concerns input validation and output encoding flaws (CWE‑79).

The flaw exists in all releases of the Repeater Fields for Elementor Forms plugin up to and including version 2.2.7, as distributed through the WordPress plugin repository. Any WordPress installation that has this plugin active and has publicly accessible forms that use repeater fields is affected. No specific WordPress core version is required for exploitation, but the affected environment must host the vulnerable plugin.

The CVSS score of 7.2 suggests a high‑severity problem. Because the attack does not require authentication and the data is stored, the probability of successful exploitation is significant, especially on sites with open forms. The EPSS score is not available, but the lack of a KEV listing indicates no known mass exploitation to date. Nonetheless, the attack vector is straightforward—an attacker posts a malicious payload through a public form—and once stored, the payload will run under any authenticated or unauthenticated user’s context, providing the attacker with a high impact.