The VPSUForm WordPress plugin is vulnerable to stored XSS due to improper neutralization of input during web page generation. This allows attackers to inject arbitrary scripts that persist in the application and execute in the context of users visiting the injected pages. The vulnerability affects all plugin versions up to 2.1.5. The CVSS vector indicates the attack requires no privileges or user interaction and can impact confidentiality and integrity with a high severity rating. No patch or official fix has been documented in the provided data.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions performed with the user's privileges. The vulnerability affects confidentiality and integrity but does not impact availability. Since the attack vector is network-based and requires no privileges or user interaction, it poses a significant risk to sites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to affected pages to trusted users only. Applying web application firewall (WAF) rules to detect and block XSS payloads may provide temporary mitigation. Monitor vendor channels for updates or patches addressing this vulnerability.