The Contact Manager plugin contains a stored XSS flaw in the title field owing to insufficient sanitization and escape handling. The bug allows an authenticated administrator to embed arbitrary scripts that are executed whenever a user accesses a page containing the injected content, potentially leading to data theft, session hijacking, or defacement. The vulnerability is confined to the injection point and does not offer remote code execution, but any user who views the compromised page can be impacted.

The flaw exists in all versions of the kleor Contact Manager plugin up to and including 8.6.5 executed on WordPress installations that are either multi‑site or have unfiltered_html disabled. Versions later than 8.6.5 are not affected and are recommended for safe operation.

The CVSS score of 4.4 classifies the bug as low to medium severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The bug is not listed in the CISA KEV catalog. Exploitation requires administrator‑level credentials; the attacker must access the admin interface to insert malicious input and then entice other users to view the page containing the embedded script. Boundaries of the attack are therefore limited to the site scope and user base that accesses the affected content.