The Contact Form 7 – CCAvenue Add-on by Mahesh Bisen suffers from a reflected Cross-site Scripting vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 1.0. The vulnerability allows attackers to inject malicious scripts that execute in users' browsers, potentially leading to data disclosure, modification, or disruption of service. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in the execution of arbitrary scripts in the context of the affected web application, potentially leading to partial loss of confidentiality, integrity, and availability. This could allow attackers to steal sensitive information, manipulate data, or disrupt service for users interacting with the vulnerable add-on.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the affected add-on to mitigate risk.