The vulnerability is an unauthenticated Cross Site Scripting flaw that allows an attacker to inject arbitrary JavaScript into the DOM of pages powered by the Database for CF7 plugin. This can result in credential theft, defacement, or other client‑side compromise for any user who visits the affected pages. The weakness is clearly a CWE‑79 input‑validation issue.

WordPress sites that have the code4life Database for CF7 plugin installed in versions 1.2.6 or earlier are affected. The flaw exists in the plugin’s handling of form data, which is exposed to visitors without authentication checks.

The CVSS score of 7.1 indicates a high impact. Active exploitation is not confirmed and the EPSS score is < 1%, indicating a very low probability of exploitation, though the exact likelihood remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an unauthenticated attacker can trigger the XSS via normal user interaction by submitting crafted form data or by visiting specially crafted links. Once triggered, the malicious script executes in the victim’s browser context, allowing the attacker to steal session cookies or perform other malicious actions.