The eForm - WordPress Form Builder plugin suffers from a Stored Cross-Site Scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. This allows unauthenticated attackers to inject malicious scripts that persist and execute in the context of users visiting affected pages. The vulnerability affects all versions up to 4.18.0. The CVSS 3.1 score of 7.2 reflects the ease of exploitation and potential impact on confidentiality and integrity. No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially resulting in theft of sensitive information, session hijacking, or other client-side impacts. The vulnerability does not affect availability. The attack requires no privileges or user interaction and can be performed remotely over the network. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for updates from WPQuark is recommended to apply any forthcoming patches promptly.