The flaw is an Improper Neutralization of Input During Web Page Generation, identified as CWE‑79, which allows a malicious user to inject script code into pages that the plugin generates. Because the Message Filter for Contact Form 7 echoes user input without sanitization, the injected script is reflected back to clients’ browsers, executing with the same privileges as the visitor. The vulnerability neither bypasses authentication nor discloses data directly, but the reflected script can perform any client‑side action available to the victim.

Any WordPress site running Kofi Mokome Message Filter for Contact Form 7 plugin version 1.6.3.8 or earlier is affected. Sites that have upgraded to a later release are not vulnerable, but those that remain on the listed versions lack the necessary input filtering.

The CVSS score of 7.1 marks this as a medium‑severity vulnerability. The EPSS score of <1 % indicates that, as of the latest data, exploitation attempts are rare. It is not included in the CISA KEV catalog. The vulnerability is exercised via reflected input; an attacker likely needs to craft a malicious payload in a URL, form, or other user‑supplied field that the plugin will render unescaped to the victim’s browser. No additional privileges or authentication are required for the initial exploitation step.