The Slim Jetpack plugin for WordPress allows unauthenticated attackers to inject arbitrary JavaScript into any page that renders the contact form. The vulnerability arises from insufficient input sanitization and output escaping of the 'Website contact‑field' parameter, leading to a stored Cross‑Site Scripting flaw (CWE‑79). An attacker can upload a malicious payload that will execute in the browsers of future visitors to the infected page, potentially exfiltrating credentials or defacing the site.

WordPress sites running the wingerspeed Slim Jetpack plugin version 2.7.0.1 or earlier. The issue exists in all releases up to and including 2.7.0.1 and affects every page that includes the [contact-form] shortcode.

The CVSS score of 7.2 indicates a moderate to high severity vulnerability. Since the attack does not require authentication or privileged access and the flaw is stored, it can be exploited by any visitor to a page with the contact form, making the attack vector wide and simple. The EPSS score is not available, but the lack of a KEV listing suggests that there are no confirmed mass exploitation reports yet. Nonetheless, the availability of a fully automated exploitation path renders this a high‑risk concern for exposed websites.