The Contact Form 7 Database Addon plugin for WordPress (CFDB7) suffers from a stored cross-site scripting vulnerability identified as CVE-2025-6740. This vulnerability is due to improper neutralization of input during web page generation (CWE-79), specifically involving the 'tmpD' parameter. Attackers can inject malicious scripts that persist in the database and execute when users view affected pages. The vulnerability affects all versions up to 1.3.1. The CVSS 3.1 score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No patch or vendor advisory is currently available.

Successful exploitation allows unauthenticated attackers to inject and store malicious scripts in the plugin's database via the 'tmpD' parameter. These scripts execute in the context of users who access the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to confidentiality and integrity with no direct availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor official channels from the plugin author for updates. Avoid accessing or sharing pages that might contain injected scripts. No vendor advisory or patch links are currently available.