The Formidable Forms plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to insufficient input sanitization and output escaping of the 'html' parameter. Authenticated attackers with form editing permissions and at least Subscriber-level access can inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability affects all versions up to and including 6.11.1. The CVSS 3.1 base score is 4.9, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with authenticated access and form editing permissions can inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who visit the affected pages, potentially leading to information disclosure or integrity issues within the affected site context. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict form editing permissions to trusted users only to reduce risk. Monitor the plugin vendor's communications for updates or patches addressing this vulnerability.