This vulnerability involves improper input sanitization in the wpwebsitecreator Website remote Install plugin for WordPress, which supports integration with Gravity, WPForms, Formidable, Ninja, and Caldera forms. It allows stored cross-site scripting attacks, where malicious input is stored and later executed in a victim's browser. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability. The affected versions are up to 4.0. No patch or official fix information is currently available.

Successful exploitation can lead to stored XSS attacks, potentially allowing attackers to execute arbitrary scripts in the context of affected users, leading to partial loss of confidentiality, integrity, and availability of the affected system or user data. The attack requires the attacker to have some privileges and user interaction, which limits the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with user input and consider disabling or restricting use of the affected plugin. Monitor for vendor updates and apply patches promptly once released.