This vulnerability in CubeWP Forms (<= 1.1.1) is a stored cross-site scripting (XSS) issue caused by improper input neutralization during web page generation. An attacker can inject malicious scripts that persist and execute when other users view affected pages. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates the attack can be performed remotely over the network, requires low complexity, no privileges, but user interaction is necessary, and it impacts confidentiality, integrity, and availability to a limited extent. No patch or official remediation information is currently provided.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of other users, potentially leading to theft of user credentials, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.1. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or limiting use of the CubeWP Forms plugin or applying any available workarounds from the vendor. Monitor official sources for updates and patches addressing this vulnerability.