The Contact Form With Shortcode plugin does not escape user input before rendering it in the page, allowing an attacker to inject arbitrary JavaScript that will be executed in the browser of any visitor. This Reflected XSS can lead to session hijacking, defacement or phishing attacks on users who access the compromised page and originates from insufficient input sanitization (CWE-79).

All installations of the Contact Form With Shortcode plugin version 4.2.5 or earlier are affected. The plugin is distributed by aviplugins.com and remains exposed on WordPress sites that have not upgraded beyond that version.

The CVSS base score of 7.1 reflects a high severity, while the EPSS score of less than 1% indicates a low current exploitation probability; however, the vulnerability is publicly disclosed and the plugin is widely used, making automated exploitation plausible. It is not yet listed in the CISA KEV catalog, but because it allows remote script execution in a user’s context it warrants prompt remediation. Attackers can exploit it simply by constructing a malicious URL that contains the vulnerable shortcode and getting a legitimate user to click on it, which is a typical Reflected XSS attack scenario.