This vulnerability in the tmontg1 Form Generator for WordPress plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 1.52. Exploitation requires an attacker with high privileges and user interaction, and it can lead to partial compromise of confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation can result in stored XSS attacks that may allow attackers to execute arbitrary scripts in the context of affected users, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The vulnerability requires high privileges and user interaction, limiting the ease of exploitation. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the vendor. Until a fix is available, restrict high-privilege user access and educate users about the risks of interacting with untrusted content within the plugin environment.