The Ultimate Addons for Contact Form 7 plugin contains a cross-site scripting vulnerability that allows authenticated contributors to execute malicious scripts within the context of a user session.

This vulnerability is a stored cross-site scripting (XSS) flaw, identified as CWE-79, which occurs due to improper neutralization of input. It requires a user with at least Contributor-level privileges to trigger the payload, which is then executed in the context of other users visiting the affected page.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of other users, including administrators. This can lead to unauthorized actions performed on behalf of the victim, session hijacking, or the defacement of site content. While the CVSS score of 6.5 categorizes this as a medium-severity issue, the potential for privilege escalation via administrative session compromise necessitates prompt attention.

Immediate Action: Update the Ultimate Addons for Contact Form 7 plugin to version 3.5.51 or the latest available release.

Proactive Monitoring: Review web server access logs for anomalous requests originating from user accounts with contributor-level permissions.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to detect and block common XSS patterns.

Public Exploit Available: No

Security teams should prioritize updating the vulnerable plugin to version 3.5.51 immediately to eliminate the risk of script injection. While the requirement for contributor-level access provides a layer of protection, internal account compromise remains a threat vector that must be mitigated by applying this patch.