This vulnerability (CVE-2024-29103) in NinjaTeam Database for Contact Form 7 is a stored cross-site scripting (CWE-79) issue caused by improper input neutralization during web page generation. It affects all versions up to 3.0.6. An attacker can inject malicious scripts that are stored and later executed in the context of users viewing the affected pages, potentially leading to data theft, session hijacking, or other impacts. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing stored data, potentially resulting in data disclosure, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The vulnerability affects the plugin's handling of input data during page generation, enabling stored XSS attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin's data views and limiting user roles that can input or view stored data. Monitor vendor channels for updates and apply patches promptly once available.