The vulnerability is an unauthenticated Cross Site Scripting flaw in the Contact Form to DB by BestWebSoft plugin for WordPress version 1.7.6 and earlier. It allows an attacker to inject arbitrary JavaScript into a page rendered to a visitor. An attacker could then steal session cookies, perform phishing, or redirect the user to malicious sites (inferred from typical XSS behavior). The weakness is a classic reflected XSS issue documented as CWE‑79.

The flaw affects the plugin known as Contact Form to DB by BestWebSoft, produced by BestWebSoft. Versions 1.7.6 and earlier are vulnerable. WordPress sites that have installed this plugin and have not applied a later update are at risk.

The CVSS score of 7.1 indicates a high severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The lack of listing in CISA’s KEV catalog suggests no known exploitation at the time of this analysis. The attack can be carried out without authentication via a crafted request to a public URL served by the plugin (inferred from the nature of unauthenticated XSS).