A reflected Cross‑Site Scripting (XSS) flaw exists in the CF7 Spreadsheets WordPress plugin. The vulnerability arises from the plugin’s failure to neutralize user‑supplied input before rendering it in a browser, allowing an attacker to inject arbitrary JavaScript that executes in the context of the victim’s browser, potentially granting access to sensitive data or session information. This weakness is categorized as CWE‑79.

The issue affects the CF7 Spreadsheets plugin from its earliest releases up through version 2.3.2. It impacts WordPress sites that have installed any of these versions, regardless of operating system or hosting environment. Updates to versions beyond 2.3.2 are not explicitly mentioned but are presumed to contain the fix.

The CVSS score of 7.1 indicates a high severity level, and the EPSS score of less than 1 % suggests that, while the vulnerability exists, the probability of exploitation at this time is low. The flaw is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, leveraging a crafted request to a form processed by the plugin; an attacker who can embed the malicious payload in a form submission can trigger the reflected XSS in any visitor’s browser that accesses the affected page.