Improper neutralization of input during web page generation leads to stored cross‑site scripting (XSS) in VaultRE Contact Form 7. Any content entered through the contact form can be persisted and later rendered unescaped, allowing an attacker to inject arbitrary scripts into pages viewed by site visitors. The resulting impact includes session hijacking, phishing, and content spoofing, affecting the confidentiality and integrity of user interactions with the site.

The vulnerability is present in the VaultRE Contact Form 7 plugin developed by Vault Group Pty Ltd. All installations running version 1.0 or earlier are affected. No specific build or patch levels are listed beyond the maximum affected version.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is below 1 %, implying a very low probability of an actively exploited incident at the time of assessment. The vulnerability is not listed in the CISA Known Exploit Vulnerabilities catalog. The likely attack pathway involves an attacker submitting a crafted message via the exposed form fields, which is stored and later rendered on the site without proper escaping. Because the vector requires input via a website page that is publicly accessible, an external attacker can easily reach it.