The Message Filter for Contact Form 7 plugin contains an unauthenticated cross‑site scripting flaw that permits an attacker to embed malicious JavaScript in form fields. When a legitimate user submits data, the plugin fails to properly sanitize input, causing the attacker’s script to execute within the victim’s browser session. This can lead to credential theft, session hijacking, or defacement of the website experience.

WordPress installations that use the Message Filter for Contact Form 7 plugin version 1.6.3.9 or earlier. The vulnerability applies to all instances where the plugin is active on public contact forms.

The CVSS score of 7.1 classifies this flaw as a high‑severity vulnerability. The EPSS score of <1% indicates a very low but nonzero probability that the flaw is being actively exploited, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread documented exploitation yet. An attacker can exploit this flaw simply by submitting crafted input via any exposed contact form, with no authentication or privileged access required.