Technical impact
Unauthenticated Cross‑Site Scripting (XSS) exists in the WordPress "Contact Form to Any API" plugin versions 3.0.3 and earlier. The flaw allows an attacker to inject arbitrary JavaScript into pages served by the site, potentially leading to session hijacking, defacement, or phishing attacks against unsuspecting visitors.
Affected Systems
The vulnerability affects users of the IT Path Solutions "Contact Form to Any API" plugin for WordPress running any release version up to and including 3.0.3. The affected component is the form processing code that fails to properly sanitize input received from form submissions.
Risk and Exploitability
The CVSS score of 7.1 classifies the flaw as high severity, while the EPSS score of less than 1% indicates a low probability of discovery and exploitation in the wild. The description states the XSS is unauthenticated, but does not detail how it is triggered. Based on the description, it is inferred that an attacker can trigger the XSS by submitting a malicious payload through the plugin's public form, making the attack vector readily reachable from the client side. The vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been widely leveraged in documented attacks.
