This vulnerability in the Tripetto WordPress form builder plugin involves improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). Specifically, malicious input can be saved and later executed in the context of the affected website, potentially compromising user sessions or enabling other malicious actions. The affected versions include all releases through 8.0.6. There is no CVSS score assigned yet, and no vendor advisory or patch information is provided at this time.

Successful exploitation of this stored XSS vulnerability could allow attackers to execute arbitrary JavaScript in the browsers of users visiting the affected site. This can lead to session hijacking, defacement, or redirection to malicious sites. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting the use of the Tripetto plugin or applying any available workarounds recommended by the vendor. Monitor the vendor's official channels for updates and patches.