The Contact Form 7 Editor Button plugin is vulnerable to reflected cross-site scripting, which could allow an unauthenticated attacker to execute malicious scripts in the context of a victim's session.

This is a reflected cross-site scripting (XSS) vulnerability (CWE-79) caused by improper neutralization of user-supplied input during web page generation. An unauthenticated attacker can exploit this via the cf7-editor-button component by tricking a user into clicking a crafted link.

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of an authenticated user, or the exfiltration of sensitive information stored within the browser session. With a CVSS score of 7.1, this represents a high-severity risk to the integrity and confidentiality of the affected WordPress environment.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and remove the Contact Form 7 Editor Button plugin from all WordPress installations until a security update is released by the vendor.

Proactive Monitoring: Review web server and application logs for suspicious URL parameters containing script tags or encoded characters that indicate probing for XSS vulnerabilities.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block malicious XSS payloads targeting the plugin's endpoints.

Public Exploit Available: No (exploit_available: false)

Given the potential for session compromise and the high CVSS rating, immediate remediation is required. Since a vendor patch is not yet available, the most effective security posture is the complete removal of the affected plugin to eliminate the attack surface entirely. Monitor the vendor advisory closely for future updates that address the identified XSS flaw.