The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress suffers from a reflected XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the plugin uses add_query_arg and remove_query_arg functions without appropriate escaping on URL parameters, allowing injection of malicious scripts. This vulnerability affects all versions up to 2.3.1 and can be triggered when the 'leave a review' notice is present in the dashboard. An attacker can exploit this by crafting a URL that, when clicked by an authenticated user, executes arbitrary JavaScript in their browser context.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected user's browser session. This can lead to information disclosure or manipulation of the user interface. The vulnerability does not allow privilege escalation or denial of service. The attack requires user interaction (clicking a malicious link) and the presence of a specific dashboard notice, limiting its scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling the 'leave a review' notice if possible or restrict access to the dashboard to trusted users only. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.