The vulnerability is an improper neutralization of user input during web page generation, which allows an attacker to inject and execute malicious JavaScript code during page rendering. The reflected cross‑site scripting flaw can be exploited to steal session cookies, perform credential theft, manipulate the DOM, or execute arbitrary actions on behalf of the victim, potentially compromising user accounts and defacing the site.

The issue affects the Quick Contact Form plugin provided by Saad Iqbal. All releases up to and including version 8.2.1 are vulnerable.

With a CVSS score of 7.1 the vulnerability is considered high severity. The current EPSS score is below 1 %, indicating a low likelihood of exploitation at this time, and it is not listed in the CISA KEV catalog. Although the specific attack vector is not expressly detailed in the advisory, it is inferred that an attacker can deliver a malicious URL that contains crafted input; any visitor to the site who triggers the form response would then be exposed to the injected script. The risk is mitigated by the low exploitation probability but remains significant due to the potential impact on confidentiality and integrity.