The Quill Forms WordPress plugin (up to version 3.10.0) suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'quillforms-popup' shortcode. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of other users viewing the injected content. The vulnerability is network exploitable with low attack complexity and no user interaction required. The impact includes limited confidentiality and integrity loss but no availability impact, reflected in a CVSS 3.1 base score of 6.4.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, unauthorized actions, or data exposure limited to the scope of the injected script. There is no indication of availability impact or exploitation in the wild at this time.

Patch status is not yet confirmed — no official fix or update has been provided by the vendor as of the published date. Users should monitor the vendor's advisory channels for updates and consider restricting contributor-level access until a patch is available. Applying strict input validation or disabling the vulnerable shortcode may reduce risk temporarily.