Improper neutralization of input during web page generation allows an attacker to inject malicious JavaScript into the contact form page. The vulnerability is DOM‑based XSS, which means the payload is executed in the victim’s browser when the page loads. This can lead to data theft, session hijacking, or redirecting the user to phishing sites.

The weakness exists in NickDuncan’s Contact Form plugin for WordPress, affecting all releases from the earliest available up to and including version 2.0.12. Any WordPress site that has the plugin installed and is not upgraded beyond 2.0.12 is potentially exposed.

The CVSS score is 6.5, indicating a medium severity flaw. The EPSS score is below 1 %, suggesting that exploitation is currently rare but still possible. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a manipulated query string or form input that contains JavaScript, which the plugin then reflects unescaped in the DOM so that any site visitor will run the code in their browser. An attacker needs only to entice a user to open the crafted link or submit the malicious form content.