A Contributor Cross Site Scripting (XSS) flaw exists in the Cool Formkit Lite plugin for WordPress versions 2.7.8 and earlier. The flaw allows a user with contributor privileges to inject crafted input that is rendered by the plugin without proper sanitization. An attacker could use this to inject malicious JavaScript into the page output, leading to defacement, credential theft, or further exploitation of the victim's browser session.

The vulnerability affects the Cool Formkit Lite plugin developed by Cool Plugins. Any WordPress installation that has this plugin version 2.7.8 or older installed is susceptible. The plugin is widely used for form creation within Elementor designs.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. The attack vector is typically web‑based, exploiting contributor level access to submit malicious form data. Sites with exposed WordPress admin interfaces or user roles that include contributors are the most at risk. Even without direct administrative access, an attacker who can acquire a contributor account could potentially exploit the flaw.