EIP-2026-114275

This exploit demonstrates a persistent XSS vulnerability in WPForms plugin version 1.6.3.1 and earlier. It shows how an authenticated attacker can inject malicious JavaScript into form descriptions, which executes when the form is previewed or viewed.