The Smart Forms WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Authenticated administrators can inject malicious scripts via the plugin's admin settings, which are then stored and executed in the context of users visiting the affected pages. This vulnerability only affects multi-site WordPress setups or installations with unfiltered_html disabled, limiting its scope. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges without user interaction. No known exploits are reported in the wild, and no patch or remediation details are currently available.

An attacker with administrator-level access can exploit this vulnerability to inject and execute arbitrary JavaScript in the context of other users visiting the affected pages. This could lead to session hijacking, privilege escalation, or other malicious actions depending on the injected script. The impact is limited to multi-site installations or those with unfiltered_html disabled, reducing the overall risk. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should carefully control access to the plugin settings and consider disabling or limiting the use of the Smart Forms plugin in multi-site environments or where unfiltered_html is disabled. Monitoring for suspicious administrator activity may help detect exploitation attempts.