The Formidable Kinetic plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'kinetic_link' shortcode. Specifically, the FrmKinetic::link() function concatenates user-supplied attributes directly into HTML anchor tag attributes without adequate sanitization or escaping. This flaw enables authenticated users with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of any user viewing the compromised page. The vulnerability is identified as CWE-79 and carries a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). There is no vendor-provided patch or official remediation level documented, and no known active exploitation has been reported.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attributes. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of page content when other users access the infected pages. Availability is not affected. Since the vulnerability requires authenticated access, the attack surface is limited to users who can contribute content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Formidable Kinetic plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.