The vulnerability arises from a cross‑site request forgery flaw in Damian Orzol’s Contact Form 7 Material Design plugin. An attacker that lures an authenticated user to a crafted URL can submit a forged request that stores arbitrary JavaScript or HTML in a form field. When that stored data is later displayed by the site, the code executes in the victim’s browser, giving the attacker access to cookies, session tokens, or the ability to perform actions on the victim’s behalf. This flaw is a classic CSRF‑to‑stored XSS attack, identified as CWE‑352.

The plugin version from the initial release through 1.0.0 is vulnerable. Systems running WordPress with Damian Orzol’s Contact Form 7 Material Design plugin version 1.0.0 or earlier are affected.

The CVSS score of 7.1 classifies the issue as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. Since the attack requires the victim to be logged in and the exploit triggers with a simple click, the risk is high for users with privileged access, although the overall likelihood remains modest. The vulnerability is not yet listed in the CISA KEV catalog.