The Smart Forms plugin for WordPress allows users to create custom forms. In versions up to and including 2.6.104, the formString parameter is stored without sanitisation or escaping. When a stored form containing this unsanitised content is later displayed, the malicious payload is rendered as part of the page, resulting in a stored cross‑site scripting flaw that can execute arbitrary scripts in the browsers of any visitor who loads the infected page.

The vulnerability affects the Smart Forms – when you need more than just a contact form plugin from edgarrojas. All releases up to 2.6.104 are impacted. Site owners running any of those versions are exposed, and because the default settings allow anonymous submissions without a nonce, no authentication is required for an attacker to inject payloads.

The CVSS score of 7.2 indicates high impact and moderate exploitation complexity. The EPSS score is below 1 %, suggesting the flaw is not currently widely exploited, and it is not listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: an unauthenticated user can post data to the rednao_smart_forms_save_form_values AJAX handler, which stores the payload and later serves it to any site visitor. The absence of authentication or nonce verification on the default installation makes this vulnerability easily exploitable for defacement, cookie theft, or session hijacking.