The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that allows a reflected cross‑site scripting (XSS) attack. An attacker can supply crafted input that is echoed back in the response, enabling the execution of arbitrary JavaScript in the victim’s browser. This can lead to session hijacking, theft of credentials, defacement, or the delivery of phishing content.

The flaw affects the WordPress Contact Form vCard Generator plugin developed by Ashish Ajani, specifically all releases up to and including version 2.4. Any WordPress site that has this plugin installed with a vulnerable version is at risk.

The vulnerability has a CVSS score of 7.1 and an EPSS less than 1%, indicating moderate severity but a low likelihood of exploitation at present. It is not listed in CISA’s KEV catalog. The attack requires a user to visit a crafted URL or submit a malicious request that is reflected by the plugin, making it a typical user‑interaction needed reflected XSS scenario. Although the prevalence is currently low, the potential impact to confidentiality and authenticity warrants timely remediation.