The Form Builder CP WordPress plugin versions prior to 1.2.47 do not properly sanitize a form configuration value before storing and using it in client-side script execution. This flaw enables authenticated users with Editor or higher privileges to perform stored cross-site scripting (XSS) attacks against visitors of pages rendering the vulnerable form. The vulnerability bypasses restrictions like the absence of the unfiltered_html capability, which is commonly used to limit script injection in multisite networks. No official patch or remediation level has been confirmed as of the published date.

Successful exploitation allows an attacker with Editor-level or higher access to inject malicious JavaScript that executes in the browsers of any visitor viewing the affected form. This can lead to theft of session tokens, defacement, or other client-side impacts. The vulnerability does not affect availability and requires user interaction (visiting the page with the form). The CVSS score of 5.4 reflects a medium severity with network attack vector, low attack complexity, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor-level and higher user access to trusted individuals only. Monitor for updates from the plugin vendor and apply any released patches promptly.