CVE-2026-94573 describes a stored cross-site scripting vulnerability (CWE-79) in the Repeater Fields for Elementor Forms plugin for WordPress. Versions from 0 up to and including 2.2.7 are vulnerable due to insufficient sanitization and escaping of repeater field inputs. This flaw enables unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An unauthenticated attacker can inject persistent malicious scripts into pages generated by the plugin, which execute in the browsers of users who visit those pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects confidentiality and integrity but does not impact availability.

No official patch or fix is currently referenced in the provided data. Users should check the vendor's advisory or plugin update channels for any forthcoming patches. Until a fix is available, consider disabling or removing the plugin to prevent exploitation. Implementing web application firewalls or input validation at other layers may provide temporary mitigation but do not replace the need for an official fix.