The Contact Form to Any API plugin for WordPress is vulnerable due to insufficient input sanitization and output escaping in the 'cf7anyapi_form_field' post meta. This flaw allows authenticated users with contributor-level access or higher to inject malicious web scripts that are stored within the plugin settings. When any site visitor loads a page that uses the injected data, the malicious script executes, enabling an attacker to tamper with the user experience, steal session data, or redirect to phishing sites.

Any WordPress installation running itpathsolutions’ Contact Form to Any API plugin version 3.0.6 or earlier is impacted. The vulnerability stems from the plugin’s handling of form field metadata during configuration, and all prior releases carry the same flaw.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity. Its EPSS score is below 1%, suggesting a low probability of active exploitation at this time, and it is not listed in the CISA KEV catalog. The attack requires the attacker to be authenticated with contributor-level or higher privileges. Once the malicious input is stored, any visitor to the affected pages will be exposed to the injected script, causing potential data theft and defacement. The risk is amplified on sites that rely heavily on user engagement or store sensitive user data.