The flaw permits an unauthenticated attacker to inject malicious script into pages served by the Fluent Forms Pro Add On Pack plugin. When a user views the compromised form, the injected code runs in their browser, potentially enabling session hijacking, cookie theft, phishing, or defacement. This is an input validation weakness identified as CWE‑79.

WordPress sites that have installed the Fluent Forms Pro Add On Pack plugin version 6.2.13 or earlier, including both the free and pro variants. Sites using these plugins should verify their installed version and upgrade if it is affected.

The CVSS score of 7.1 indicates high severity with network scope and significant impact. Because the attack requires no authentication, an adversary can craft a malicious form or link to trigger the XSS. The EPSS score is <1%, indicating a very low but nonzero exploitation probability. The public advisory and lack of KEV listing suggest no documented exploitation yet; nevertheless the risk remains high until the patch is applied.