The Redirection for Contact Form 7 plugin contains insufficient input sanitization on the qs_date shortcode, allowing an authenticated user with contributor or higher privileges to inject arbitrary JavaScript into stored post content. Once injected, the script runs automatically whenever any user visits the affected page, potentially leading to theft of credentials, defacement, or full compromise of the victim’s browser context. The weakness is a classic stored cross‑site scripting flaw (CWE‑79).

WordPress sites that have installed the Redirection for Contact Form 7 plugin from themeisle, versions 3.2.6 and earlier. The plugin is widely used to redirect after form submission, so any site running these versions is at risk.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1 % suggests a low exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw requires only contributor‑level authentication—a role common in many sites—and the payload is stored in the database, a successful exploit can affect all site visitors. Attackers would typically create or edit a post that contains the malicious qs_date shortcode, ensuring the payload persists until removed.