The 'Inquiry Form to Posts or Pages' WordPress plugin suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation (CWE-79). Specifically, the 'Form Header' field is not sanitized properly when saved using update_option(), and the stored value is output without appropriate escaping in two places: the plugin settings page (inq_form.php line 180) and the front-end shortcode output (inquery_form_to_posts_or_pages.php line 139). This allows authenticated users with administrator privileges to inject arbitrary JavaScript that executes in the context of users viewing affected pages or the settings page.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who access the plugin settings page or any page containing the affected shortcode. This can lead to information disclosure or session hijacking limited to the scope of the injected script. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity, with no impact on availability.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict administrator access to trusted users only and consider removing or disabling the plugin if possible to prevent exploitation.