This vulnerability (CVE-2024-23522) in the Formidable Forms plugin by Strategy11 Form Builder Team is classified as CWE-80, indicating improper neutralization of script-related HTML tags in web pages. It allows an attacker to inject code via unsanitized input fields, resulting in a basic cross-site scripting (XSS) vulnerability. The issue affects versions up to 6.7. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to integrity (code injection) without confidentiality or availability impact. No patch or official remediation level has been disclosed, and no known exploits are currently reported.

The vulnerability allows an attacker to inject malicious scripts into web pages generated by the affected Formidable Forms plugin, potentially leading to code injection. This can compromise the integrity of the affected web application but does not impact confidentiality or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds recommended by the vendor or restrict access to vulnerable forms to trusted users only. Monitoring vendor updates is essential to apply patches promptly once available.