This vulnerability in VaultRE Contact Form 7 (<= 1.0) allows stored cross-site scripting due to improper input neutralization during web page generation. The CVSS 3.1 score is 5.9 (medium), with attack vector network, low attack complexity, requiring high privileges and user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability enables an attacker with high privileges to inject malicious scripts that persist and execute in the context of other users or administrators. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation could allow an attacker with high privileges to execute stored malicious scripts, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. The impact is limited by the requirement for high privileges and user interaction, reducing the likelihood of widespread exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege user access and carefully validate and sanitize inputs in the affected plugin. Monitor for updates from Vault Group Pty Ltd regarding official patches or mitigations.