The Creative Contact Form plugin by Creative-Solutions suffers from a CSRF vulnerability that enables an attacker to submit crafted requests on behalf of an authenticated user. This can result in Stored XSS, where malicious scripts are permanently stored and executed in the context of users interacting with the contact form. The vulnerability affects all versions up to 1.0.0. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to Stored XSS, allowing attackers to execute arbitrary scripts in users' browsers, potentially leading to session hijacking, defacement, or other malicious actions. The CSRF aspect means attackers can trick authenticated users into submitting malicious requests without their consent. This impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin to mitigate risk. Implementing CSRF protections and input validation may reduce exposure but are not confirmed as available mitigations for this specific vulnerability.