The HTML Forms – Simple WordPress Forms Plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) due to insufficient input sanitization and output escaping in admin settings. Authenticated users with administrator-level permissions can inject arbitrary web scripts that execute when other users access the affected pages. This issue affects all plugin versions up to and including 1.5.5 and specifically impacts multi-site installations or installations where unfiltered_html is disabled. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction. There is no indication of known exploits in the wild or an available patch.

An attacker with administrator-level permissions can inject persistent malicious scripts into pages via the plugin's admin settings. This can lead to limited confidentiality and integrity impacts through script execution in users' browsers. The vulnerability does not affect availability. The attack requires high privileges and affects multi-site or restricted HTML filtering WordPress environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrator access to trusted users and consider disabling or removing the affected plugin in multi-site or unfiltered_html-disabled environments to reduce risk.