The Formidable Forms plugin for WordPress, versions up to and including 6.16.1.2, contains a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, POST-based Custom HTML Form parameters are not sufficiently sanitized or escaped, enabling unauthenticated attackers to inject malicious scripts. Successful exploitation requires user interaction, such as clicking a crafted link, which then executes the injected script in the context of the victim's browser session.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure, session hijacking, or other user-targeted attacks. The vulnerability does not require authentication and affects confidentiality and integrity with no impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and avoid clicking suspicious links related to the affected plugin. Monitor the vendor's communications for updates on patches or official mitigations.