The vulnerability is a stored cross‑site scripting flaw (CWE‑79) in the Submission DOM tracking for Contact Form 7 plugin, where user input is rendered on a page without proper neutralization. An attacker can submit malicious JavaScript that is saved by the plugin and later served to anyone who views the affected form. The injected script runs in the victim’s browser and can hijack sessions, deface the site, or deliver malware, compromising both confidentiality and integrity of the target environment.

The affected product is the Submission DOM tracking for Contact Form 7 plugin by apasionados. Versions from the earliest release through 2.1 are vulnerable. Any WordPress site that has installed the plugin and is running a version less than or equal to 2.1 should identify whether it is present and determine the need for remediation.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need a victim to visit a page that renders the stored payload, so user interaction is required. The impact is confined to the victim’s browser, but the broader site can suffer defacement or malware propagation, especially on high‑traffic or publicly visible forms.