The Database for CF7 plugin accepts array‑structured input for ordinary text fields through the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback. The plugin stores this data in a custom wp_cf7db table using serialize() without applying WordPress sanitization or escaping. As a result, a malicious user can inject arbitrary JavaScript into the stored form data. When an affected WordPress site displays the stored submission, the injected script runs in the victim’s browser, enabling cookie theft, session hijacking, defacement, or delivery of malware. This is a classic Stored Cross‑Site Scripting (XSS) that compromises user confidentiality and integrity but does not provide direct server‑side access.

The vulnerability affects the Database for CF7 plugin from code4life. All released versions up to and including 1.2.6 are impacted. Users running any of those versions with an active Contact Form 7 endpoint are at risk. The plugin stores data in a wp_cf7db table, and the REST API is publicly reachable on any WordPress installation that has the plugin active.

The CVSS score is 7.2, indicating high severity. The EPSS score is below 1%, suggesting a low current exploitation probability, yet the vulnerability remains a known candidate for abuse. It is not listed in CISA’s KEV catalog. Exploitation does not require authentication; any unauthenticated attacker can POST malicious payloads to the public API. The attack path is straightforward: send a specially crafted array input through the REST endpoint, the plugin stores it without sanitization, and the data is later rendered on pages accessed by any user. Because the input bypasses WordPress’ wp_insert_post/wp_kses filters, the stored script is delivered verbatim to browsers. The impact is browser‑side code execution for anyone viewing the injected page.