The Zero Spam for WordPress plugin allows an unauthenticated attacker to inject arbitrary HTML or JavaScript into website pages. When a Contact Form 7 request is submitted with a specially crafted nested POST array key, the plugin stores the raw field name in the zerospam_log.submission_data column because not all fields are sanitized or escaped. This stored data is rendered in the admin interface or on public pages, causing the injected script to execute in any browser that loads the affected page, leading to potential defacement, data theft, or session hijacking. The flaw is a classic stored Cross‑Site Scripting vulnerability identified as CWE‑79.

Zero Spam for WordPress plugin version 5.7.10 and earlier. All WordPress sites that have installed this plugin and use the Contact Form 7 integration are affected unless the plugin version is newer than 5.7.10.

The CVSS score of 7.2 indicates a high severity of the vulnerability. Attackers can exploit it without authentication by submitting a crafted request via any exposed Contact Form 7 form. The stored data remains unchanged in the database, and when a user accesses a page that displays this data, the embedded script will execute in the browser, allowing the attacker to run arbitrary code in that context. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, so the exploitation probability cannot be quantified.