The Contact Form 7 Material Design plugin by Damian Orzol contains a CSRF vulnerability that enables stored XSS attacks. This affects all versions up to 1.0.0. The vulnerability allows an attacker to trick an authenticated user into submitting a malicious request, resulting in stored malicious scripts within the application. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality, integrity, and availability with a scope change.

Successful exploitation of this vulnerability can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected application. This can result in data disclosure, modification, or disruption of service. The vulnerability affects confidentiality, integrity, and availability, but exploitation requires user interaction. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version. Applying web application firewall (WAF) rules to detect and block CSRF and XSS attempts may provide temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.