The HTML Forms – Simple WordPress Forms Plugin for WordPress suffers from an unauthenticated stored cross-site scripting vulnerability (CWE-79) in all versions up to and including 1.6.0. The issue is due to inadequate sanitization of fabricated file upload field metadata, which is then displayed in the WordPress admin dashboard's form submissions page. This flaw enables attackers without authentication to inject arbitrary web scripts that execute in the context of an administrator's browser session when accessing the affected page. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction required, impacting confidentiality and integrity with no availability impact.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary scripts in the administrator's browser when viewing form submissions. This can lead to partial confidentiality and integrity compromise, such as theft of admin session cookies or manipulation of admin interface content. There is no direct impact on system availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit access to the form submissions page to trusted users only and consider disabling or removing the vulnerable plugin. Monitoring for suspicious activity related to admin dashboard access is advisable. Avoid interacting with untrusted form submissions or file uploads that could contain malicious metadata.