The vulnerability is an improper neutralization of input that enables stored cross‑site scripting. An attacker can inject malicious script content, which will be executed in the context of a victim’s browser when the affected page is loaded. The attack does not provide direct code execution on the server, but it can compromise confidentiality, integrity, and availability of user sessions, and facilitate credential theft or further attacks against the site and its users.

The plugin Contact Form Email from codepeople is affected for all versions from the earliest available up through 1.3.52. Any WordPress installation that has this plugin installed and has not been updated to a newer version is at risk.

The CVSS score of 5.9 indicates moderate risk. The EPSS score of < 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely local (the attacker must craft a form submission that is stored by the plugin), requiring the victim to load a page that displays the stored data. Without a user interaction that triggers the page load, the exploit does not automatically propagate. The weakness is CWE‑79, a common input validation flaw.