The vulnerability permits attackers to insert arbitrary script code into fields of the Contact Form DB for Enfold plugin by bypassing input sanitization and output escaping. These malicious scripts are stored and later echoed unescaped inside an HTML title attribute and within a table cell when the page is rendered, causing the script to execute in the browsers of any users who view the stored contact form entries. This reflects a classic Stored XSS vulnerability (CWE‑79).

The issue affects the WordPress plugin Contact Form DB for Enfold from the vendor doctorwp, with all released versions up to and including 2.0.2 vulnerable. No version beyond 2.0.2 is marked as affected in the available data.

The CVSS score of 7.2 indicates a moderate‑to‑high severity. The EPSS score of less than 1% signals a low probability that the vulnerability is being actively exploited at present, and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw unauthenticated by submitting malicious data to the contact form; the payload will later be delivered to browsers that view the stored contact form entries. Because the flaw requires only standard HTTP requests and does not require privileged access, exploitation is relatively straightforward for a determined attacker.