The Formulario de contacto SalesUp! plugin for WordPress suffers from improper neutralization of input during web page generation, allowing an attacker to inject arbitrary JavaScript via reflected XSS. When a victim follows a crafted link or submits a malicious form value, the unescaped payload executes in the victim's browser, enabling session hijacking, credential theft, or defacement.

The vulnerability impacts the salesup2019 Formulario de contacto SalesUp! plugin on WordPress installations. Versions from the initial release through <= 1.0.14 are affected; any installation using these versions must be evaluated.

The CVSS score of 7.1 indicates high severity. The EPSS score is less than 1 %, suggesting low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to craft a URL or form payload that contains malicious JavaScript and entice a user to interact with it.