The WP Easy Contact plugin is vulnerable to stored cross‑site scripting through the noaccess_msg parameter. Authenticated users with Contributor-level or higher privileges can inject arbitrary JavaScript into this field, and the content is stored and later rendered without proper sanitization or escaping. When a user accesses a page that includes the stored message, the browser executes the injected script.

The Simple Contact Form Plugin for WordPress – WP Easy Contact, developed by emarket‑design, is affected in all releases up to and including version 4.0.1.

The CVSS score of 6.4 indicates a moderate severity vulnerability, and the EPSS score of less than 1% suggests a low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated with Contributor or higher privileges and to submit a crafted noaccess_msg via the plugin interface. Once stored, the script executes automatically for any visitor of the affected page.