Themekraft BuddyForms versions up to 2.8.12 contain a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This allows an attacker with high privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The vulnerability is network exploitable and affects the web interface of the plugin.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of affected users, potentially leading to limited confidentiality, integrity, and availability impacts. The CVSS vector indicates that user interaction is required and the attack scope is changed, but the overall impact is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege user access and monitor for suspicious activity related to BuddyForms inputs. Avoid enabling untrusted users to submit content that could be rendered by the plugin.