The WordPress plugin "UTM tags tracking for Contact Form 7" contains an improper neutralization of input during web page generation, enabling a reflected XSS payload when user-supplied data is included in the UTM tags. An attacker who can supply or influence UTM tag values can inject JavaScript that executes in the context of the site, potentially allowing script execution, data theft, or phishing attacks against site visitors.

The vulnerability affects the "UTM tags tracking for Contact Form 7" plugin developed by Max K, version 2.1 and earlier. The plugin is commonly integrated with the Contact Form 7 forms to track marketing attribution.

The CVSS base score is 7.1, indicating a high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation at the current time and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is via the web interface where UTM tag parameters are submitted or echoed back, so an attacker can influence a visitor to the site by crafting a URL or form submission that includes malicious input.