The Free Theme Builder for Elementor WordPress plugin versions prior to 1.6.7 do not properly sanitize user-submitted contact form field values. This results in a stored XSS vulnerability (CWE-79) where unauthenticated attackers can inject malicious scripts into form submissions. These scripts execute in the context of the admin dashboard when a logged-in administrator views the affected form entries, potentially leading to session hijacking or other malicious actions.

Unauthenticated attackers can inject persistent malicious scripts into contact form submissions. These scripts execute in the administrator's browser when viewing the submissions, potentially compromising administrator accounts or enabling further attacks within the admin context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the admin dashboard to trusted users only and avoid viewing untrusted form submissions. Monitor vendor channels for updates and apply official patches once released.