The Contact Form 7 with ChatWork plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the 'api_token' and 'roomid' settings do not properly sanitize or escape input, enabling authenticated users with administrator privileges to inject malicious scripts. These scripts execute in the context of the settings page, affecting multi-site WordPress installations or those where unfiltered_html is disabled. The vulnerability has a CVSS 3.1 base score of 4.4, with network attack vector, high attack complexity, requiring high privileges, no user interaction, and partial impact on confidentiality and integrity.

An authenticated administrator on a vulnerable WordPress multi-site or restricted unfiltered_html installation can inject and execute arbitrary JavaScript in the settings page context. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or unauthorized actions within the admin interface. There is no impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider monitoring for suspicious activity related to the plugin settings. Avoid disabling unfiltered_html if possible. No official patch or workaround has been published at this time.