The PeproDev CF7 Database plugin, used within WordPress sites, contains a stored Cross‑Site Scripting flaw that allows an attacker to insert malicious script into data that is subsequently displayed on the site. This weakness, categorized as CWE-79, could let an attacker execute arbitrary code in the browsers of any visitor who views the affected content, potentially leading to defacement, phishing, or theft of session cookies.

The flaw impacts the PeproDev CF7 Database plugin from (unknown earliest version) through version 2.0.0. Site operators running any of these versions are affected; the vendor is Pepro Dev under the PeproDev CF7 Database group.

The CVSS score of 7.1 indicates a high severity, while the EPSS of less than 1% suggests a low current exploitation probability. The vulnerability is not yet listed in CISA KEV. An attacker would need to supply malicious input via the plugin’s data entry feature; the stored payload would be rendered unescaped, enabling script execution in the browsers of any user who accesses the data. Because the flaw involves stored data, the impact can reach anyone who visits the affected pages.