The Contact Form 7 Database Addon for WordPress is vulnerable to stored cross‑site scripting via the tmpD parameter in all versions up to and including 1.3.1 because the plugin does not properly sanitize or escape the input before storing it. An unauthenticated attacker can place arbitrary JavaScript in tmpD that is persisted in the database and will run in a visitor’s browser whenever the affected page is displayed.

WordPress sites that employ the Database Addon for Contact Form 7 – CFDB7 plugin produced by arshidkv12. Versions up to and including 1.3.1 are impacted; later releases are presumed fixed.

The CVSS score of 6.1 places the issue in the medium‑severity range. The EPSS score of less than 1% indicates that exploitation in the wild is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. An attacker would issue a web‑based request containing malicious data in the tmpD parameter without needing authentication; the stored script would then execute in the browsers of any user visiting the page where the data is displayed.