CVE-2025-12834 is a reflected cross-site scripting vulnerability in the Accept Stripe Payments Using Contact Form 7 plugin for WordPress, affecting versions up to 3.1. The issue stems from improper neutralization of input in the 'failure_message' parameter, enabling attackers to inject malicious scripts that execute in the context of a victim's browser if they are tricked into clicking a crafted link. The vulnerability requires no privileges and has a low attack complexity but requires user interaction. It impacts confidentiality and integrity but not availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to information disclosure or manipulation of web content. The vulnerability does not affect system availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links involving the 'failure_message' parameter and consider disabling or restricting the plugin if possible. Monitor the vendor's channels for updates or patches addressing this vulnerability.