The themelogger Contact Form 7 Star Rating plugin versions up to 1.10 suffer from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers with high privileges and requiring user interaction to inject malicious scripts that can impact confidentiality, integrity, and availability to a limited extent. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, and user interaction needed, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when viewed by users, potentially leading to limited data disclosure, modification, or disruption of service. The impact is rated medium based on the CVSS score of 5.9. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — no official fix or vendor advisory is available at this time. Security teams should monitor the vendor's communications for updates and apply any future patches promptly. Until a fix is released, restrict high-privilege user access and limit exposure of the vulnerable plugin where possible.