The CVE affects the Contact Us Page – Contact People WordPress plugin and allows a stored XSS vulnerability via the style parameter. Unsanitized input is stored and rendered in pages, letting an authenticated user with contributor or higher privileges inject arbitrary JavaScript. When any visitor loads the affected page, the attacker’s script runs with the visitor’s browser context, potentially capturing cookies, session data or executing further malicious actions.

Vendors and products affected include a3rev’s Contact Us Page – Contact People plugin for WordPress. All versions up to and including 3.7.4 are vulnerable; the issue is not present in newer releases beyond that threshold.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score below 1% suggests a low but nonzero exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to be authenticated as a contributor or higher, and the attack vector is through the plugin’s style parameter during normal use. Once compromised, the attacker can execute arbitrary scripts in the context of any user who views the injected page.