This vulnerability in silverplugins217's Dynamic Text Field For Contact Form 7 plugin allows stored cross-site scripting due to improper input neutralization during web page generation. It affects all versions up to 1.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No known exploits are reported in the wild. The plugin is not a cloud service, so remediation depends on vendor patching or user updates.

Successful exploitation can lead to stored XSS attacks, potentially allowing attackers to execute arbitrary scripts in the context of affected users. This can result in limited confidentiality loss, integrity compromise, and availability impact as indicated by the CVSS vector. However, exploitation requires user interaction and low privileges, reducing the overall risk severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin or applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates regarding patches or official fixes.