A stored cross‑site scripting flaw exists in the Redirection for Contact Form 7 WordPress plugin before version 3.2.12. The plugin does not sanitize or escape data submitted to a lead entry before displaying it in the lead debug metabox. An attacker who can post a malicious script to a lead entry can cause any logged‑in user viewing that debug information to execute arbitrary JavaScript, potentially compromising the site. This vulnerability is an example of an input validation weakness (CWE-79).

WordPress sites that run the Redirection for Contact Form 7 plugin in any version from 2.2.7 up through 3.2.11, inclusive, and that have the plugin’s debug mode enabled. Versions 3.2.12 and later contain the patch that properly sanitizes lead data.

Because the defect allows unauthenticated users to store malicious scripts that will be executed when an authenticated user opens the debug metabox, the attack vector involves an unauthenticated form submission followed by an authenticated view. The CVSS score of 7.5 indicates high severity, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet. The combination of easy data persistence and privileged execution in the debug interface still makes this a high‑risk issue for sites that enable the plugin with debug mode active.