This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Ninja Forms Contact Form plugin for WordPress. Specifically, the plugin fails to adequately sanitize and escape the image title field embedded in forms, allowing stored cross-site scripting attacks. Authenticated attackers with author-level access or above can inject arbitrary JavaScript code that executes in the context of users viewing the compromised form pages. The vulnerability affects all plugin versions up to 3.8.0. The CVSS 3.1 base score is 4.6, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges and user interaction.

Successful exploitation allows an authenticated user with author-level permissions or higher to inject malicious scripts into form pages. These scripts execute in the browsers of users who access the injected pages, potentially leading to session hijacking, defacement, or other script-based attacks. The impact is limited by the requirement for authenticated access with author-level privileges and user interaction to trigger the script execution. There is no indication of denial of service or direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit author-level access to trusted users only and consider disabling or restricting the use of image titles in forms. Monitor for updates from the plugin vendor or WordPress security advisories to apply any forthcoming patches promptly.