An unauthenticated Cross‑Site Scripting vulnerability, identified as CWE‑79, exists in CF7 Views – Complete Entry Management for Contact Form 7 for WordPress versions 3.2.6 and earlier. The flaw allows an attacker to inject arbitrary script code into the entry data stored by the plugin, which is rendered unescaped in the plugin’s administration and front‑end interfaces. If an attacker succeeds, the embedded script can execute in the browser of any user who views the affected entry, potentially enabling session hijacking, defacement, or delivery of additional malware.

The CF7 Views – Complete Entry Management for Contact Form 7 plugin from Aman, versions 3.2.6 and earlier, when installed on a WordPress site, is vulnerable. Any WordPress installation that includes these plugin releases, regardless of role permissions, is at risk.

The CVSS score of 7.1 indicates a high‑severity issue. An attacker does not need authentication and can exploit the flaw simply by accessing the plugin’s entry display, which is generally reachable via the public site or the WordPress admin area. The EPSS score is 0.00191, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The lack of authentication requirement means that the potential for exploitation remains significant, especially on public sites where the plugin interface is accessible.