The Form Builder CP WordPress plugin versions prior to 1.2.47 do not properly sanitize form configuration values before storing and embedding them in client-side scripts. This flaw enables authenticated users with Editor or higher privileges to perform stored XSS attacks against visitors of pages containing the vulnerable form. The vulnerability bypasses restrictions on the 'unfiltered_html' capability, increasing the attack surface in multisite WordPress installations. No CVSS score or official remediation level is provided, and no patch information is currently available.

An attacker with Editor-level or higher access can inject malicious JavaScript that executes in the context of any visitor viewing the affected form. This can lead to session hijacking, defacement, or other client-side attacks against site visitors. The vulnerability affects the confidentiality and integrity of visitors' interactions with the site. The threat does not require the attacker to have unfiltered HTML capabilities, broadening the scope of potential exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor-level access to trusted users only and consider disabling or removing the Form Builder CP plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.