The Vulnerability is an improper neutralization of input during web page generation, allowing stored cross‑site scripting on sites using CRM Perks Integration for Contact Form 7 and Constant Contact. When an attacker supplies crafted data, the malicious script is persisted and later rendered in a user’s browser. This can lead to cookie theft, session hijack, defacement or disclosure of sensitive information to the attacker.

The flaw occurs in the CRM Perks Integration for Contact Form 7 and Constant Contact plugin for WordPress, affecting all releases through version 1.1.7. WordPress sites that incorporate that plugin and have not applied an upgrade are susceptible.

The CVSS score of 5.9 indicates moderate severity, with an EPSS score below 1% suggesting low historical exploitation probability. The vulnerability is not listed in CISA KEV, which reduces the urgency compared to known exploited flaws. Based on the description, it is inferred that the likely attack vector is through the plugin’s data entry interface, where an attacker can submit a malicious value that is later stored and rendered to other site visitors.