Stored XSS Vulnerability in FormGent WordPress Plugin

The FormGent AI Form Builder plugin for WordPress (versions 1.9.2 and below) contains a critical stored cross-site scripting (XSS) vulnerability. The flaw exists due to insufficient sanitization of user-supplied data within form submission fields. Because the plugin fails to properly escape input before rendering it on administrative or public-facing pages, an unauthenticated attacker can submit malicious JavaScript payloads through the plugin's forms. Once submitted, these scripts are stored in the WordPress database and automatically execute in the browser context of any user, including administrators, who subsequently accesses the page where the form entries are displayed. This vulnerability poses a significant risk for account takeover, session theft, and unauthorized actions within the WordPress environment.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to perform actions on behalf of privileged users, including administrators. This can lead to full site compromise, unauthorized administrative actions, redirection of users to malicious domains, or the theft of sensitive session cookies. Organizations utilizing this plugin for public-facing forms are at high risk of exploitation from external threats.

Recommendation

Prioritized actions for security teams:

• Update the FormGent plugin to the latest version (v1.9.3 or higher) immediately to ensure proper input sanitization is applied.
• Review WordPress administrative logs for suspicious modifications performed by non-administrator accounts.
• Deploy the WAF rule below to detect and block malicious script injection attempts targeting the plugin's submission endpoint.