The vulnerability CVE-2024-38724 affects the Contact Form 7 Summary and Print plugin by Muhammad Rehman. It is characterized by a combination of CWE-352 (Cross-Site Request Forgery) and CWE-79 (Stored Cross-Site Scripting) vulnerabilities. The issue arises from improper neutralization of input during web page generation, allowing an attacker to perform stored XSS attacks via CSRF vectors. The CVSS v3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability. The vulnerability affects all versions up to 1.2.5. No patch or official remediation level has been published yet.

Successful exploitation can lead to stored XSS attacks facilitated by CSRF, potentially allowing attackers to execute malicious scripts in the context of affected users. This can result in partial confidentiality, integrity, and availability impacts. The vulnerability is exploitable remotely without privileges but requires user interaction. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the affected plugin or limiting its use to trusted environments. Monitor official Muhammad Rehman or Contact Form 7 plugin advisories for updates. Avoid clicking on suspicious links or interacting with untrusted web content that could trigger CSRF attacks.