This CVE describes a stored XSS flaw arising from insufficient input sanitization in the Contact Form 7 – Post Fields plugin. An attacker who can insert arbitrary values into the plugin’s post fields may cause web pages to render malicious scripts. The resulting compromise can lead to session hijacking, cookie theft, or defacement of pages viewed by legitimate users, affecting confidentiality, integrity, and availability of the site.

WordPress installations that have the Contact Form 7 – Post Fields plugin version 2.6.0 or earlier are vulnerable. The plugin is distributed by Markus Wiesenhofer through the WordPress plugin repository and is commonly used in sites that rely on Contact Form 7 for form handling. No other vendors or products are listed as affected.

The CVSS score is 6.5, indicating a medium–high severity. EPSS data is not available, so exploitation probability cannot be quantified. The vulnerability is not present in CISA’s KEV catalog. Attackers likely exploit the flaw by submitting crafted data through the form interface, which the plugin stores and later injects into web pages without proper escaping. The attack requires only the ability to submit form data, which is typically accessible to anyone who can reach the form.