CVE-2024-3715 is a stored Cross-Site Scripting vulnerability in the crmperks Database for Contact Form 7, WPforms, Elementor forms WordPress plugin, affecting all versions up to and including 1.3.8. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), allowing unauthenticated attackers to inject arbitrary web scripts that execute when users access the injected pages. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows an unauthenticated attacker to inject and store malicious scripts within the plugin's managed pages, which execute in the context of users visiting those pages. This can lead to unauthorized disclosure of information and modification of data (confidentiality and integrity impacts). There is no indication of availability impact. The vulnerability affects all users who access the injected content, potentially compromising their session or data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to affected plugin features, disabling the plugin if feasible, or applying web application firewall (WAF) rules to detect and block malicious input patterns related to stored XSS. Monitor vendor channels for updates and apply official patches promptly once available.