The Contact Form 7 Redirect & Thank You Page plugin for WordPress suffers from a reflected cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the 'post' parameter. This allows unauthenticated attackers to inject malicious scripts that execute when a user interacts with a crafted link. The vulnerability affects all versions up to 1.0.7. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and limited confidentiality and integrity impact without availability impact. There is no indication of known exploits in the wild or an available patch at this time.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in limited confidentiality and integrity impacts such as theft of user data or session tokens. The vulnerability does not affect availability. Since the attack requires user interaction and is reflected, the risk is moderate. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or replacing the vulnerable plugin to mitigate risk. Additionally, educating users to avoid clicking suspicious links can reduce exposure. Monitor the vendor's channels for updates regarding patches or official mitigations.