FormyChat EUVD-2026-43454

Exploitation requires the FormyChat (social-contact-form) plugin to be installed and active at version 2.15.3 or earlier, and requires an attacker to reach an input that the plugin stores and later renders without neutralization (CWE-79). Per the CVSS vector the initial injection needs no authentication (PR:N) and no special configuration, but it is gated by user interaction (UI:R): the payload only executes when a victim - potentially an administrator reviewing stored form data - loads the page containing it. That viewer-dependence, plus the requirement that the vulnerable form/render path actually be exposed and used, is the primary limiting factor on realistic exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 High) describes a network-reachable, low-complexity, unauthenticated attack that requires victim interaction (a user or admin loading the page holding the stored payload) and yields limited confidentiality, integrity, and availability impact across a changed scope - the classic stored-XSS profile. No EPSS score, KEV entry, SSVC decision, or POC was provided in the intelligence, so real-world exploitation likelihood cannot be quantified from the data; the absence of these signals means this should be treated as a routinely patchable High rather than an emergency. The most notable tension is PR:N combined with UI:R: exploitation is unauthenticated to plant the payload but only fires when a victim views the content, so realized impact depends on who views it - admin-viewed sinks (e.g. form submissions in wp-admin) are materially more dangerous than public-facing ones. Verify the exact injection point and viewer context with the Patchstack advisory before finalizing priority.

An attacker submits a crafted entry (for example through a FormyChat contact/chat field or an input that FormyChat later renders) containing a malicious <script> or event-handler payload, which the plugin stores without proper sanitization. When a site administrator or visitor subsequently opens the page or admin screen that renders that stored value, the JavaScript executes in their browser under the site's origin, enabling session/cookie theft or actions on the victim's behalf. No public POC was provided, and the low attack complexity (AC:L) with no privileges (PR:N) makes the injection step straightforward, though execution waits on the required user interaction (UI:R).