The Simple Contact Forms plugin for WordPress does not properly neutralize user input before rendering it. This flaw allows a malicious actor to submit JavaScript that is stored in the database and executed later when other site visitors view the affected content. The vulnerability is a classic input validation flaw (CWE‑79). Based on the title and description, an attacker can inject this payload through a CSRF mechanism that submits form data on behalf of a logged‑in user.

WordPress sites that use the owenr88 Simple Contact Forms plugin version 1.6.4 or earlier. These installations store submitted form data in the database and output it on the site, making the stored content publicly viewable.

The CVSS score of 7.1 places the vulnerability in the high‑severity range, while the EPSS score of less than 1% indicates that exploitation is currently uncommon. The problem is not listed in the CISA KEV catalog. Attackers would need a logged‑in user with permission to submit the form, leveraging the CSRF flaw to deliver a malicious payload. Once stored, each visitor who loads the page containing the data can be subjected to the embedded script.