The Pay with Contact Form 7 plugin is vulnerable to reflected cross-site scripting, which could allow unauthenticated attackers to execute malicious scripts in the context of a user's browser.

This vulnerability is caused by improper neutralization of input during web page generation (CWE-79), specifically allowing reflected XSS. The vulnerability is exploitable by an unauthenticated attacker via a crafted URL that triggers script execution in the browser of a victim.

Successful exploitation of this reflected XSS vulnerability could lead to the theft of session cookies, unauthorized actions performed on behalf of authenticated users, or the redirection of users to malicious websites. Given the CVSS score of 7.1, this flaw presents a significant risk to user integrity and session security, potentially impacting the confidentiality and availability of user data within the WordPress environment.

Immediate Action: Users should immediately disable or remove the Pay with Contact Form 7 plugin until a security update is provided by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious URL parameters containing script tags or encoded JavaScript patterns that target the plugin's endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common cross-site scripting patterns and malicious input vectors in URI queries.

Public Exploit Available: Unknown.

The presence of a high-severity XSS vulnerability in a plugin that handles form submissions warrants immediate attention. Administrators should prioritize deactivating the affected software and monitoring for any signs of exploitation until a patched version is released by the developer.