A DOM‑based cross‑site scripting flaw exists in the Aman CF7 Views plugin for WordPress. When the plugin’s entry‑management interface renders user data without proper neutralization, it can execute in the victim’s browser. This can lead to theft of session cookies, hijacking of authenticated users, or defacement of the site. The vulnerability is rated CVSS 7.1, indicating a high severity for input handling issues.

Any WordPress installation running Aman CF7 Views – Complete Entry Management for Contact Form 7 plugin. The issue remains until a more recent release is installed. Users of earlier versions should confirm the exact installed revision to determine exposure.

The EPSS score of less than 1% indicates a low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The vulnerability remains a DOM‑based XSS that enables attackers to inject scripts into the plugin’s entry‑management interface. The likely attack vector is a web‑based input surface: an attacker can create or modify an entry containing malicious JavaScript, which will execute in the browser of any user who views that entry page. This can compromise confidentiality by stealing session cookies, allow other attacks on the site, or facilitate phishing. Given the high CVSS score of 7.1 and the low exploit probability, patching should be prioritized while monitoring for exploitation attempts.