The Easy Contact plugin for WordPress contains an Improper Neutralization of Input During Web Page Generation vulnerability, classified as CWE‑79. The flaw allows malicious input to be reflected back into the page without adequate sanitization, enabling attackers to inject arbitrary JavaScript into a victim’s browser. Such reflected XSS can lead to session hijacking, credential theft, or the delivery of phishing content to users of sites that use the plugin.

The vulnerability affects the scottwallick Easy Contact WordPress plugin. All releases from its initial version up through 0.1.2 are impacted; any deployment that includes 0.1.2 or an earlier version is considered vulnerable.

With a CVSS score of 7.1, the potential impact is medium to high, and the EPSS score of less than 1 % indicates that widespread exploitation has not been observed yet. The likely attack vector is client‑side: an attacker can supply malicious input via query parameters or form fields that are reflected back into the page, without requiring authentication or server‑side code execution. The flaw is not listed in the CISA KEV catalog at present, but its moderate‑to‑high severity warrants attention if the plugin is in use.