The Redirection for Contact Form 7 plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in the qs_date shortcode. This vulnerability arises from improper neutralization of input during web page generation, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of any user who accesses the compromised page, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 3.2.6. There is no vendor advisory or patch link provided at this time, and no known exploits in the wild have been reported.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the qs_date shortcode. This can lead to client-side script execution in other users' browsers, potentially resulting in information disclosure or session compromise. The vulnerability does not affect availability and requires authenticated access, limiting the attack surface. The CVSS score of 6.4 reflects a medium impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Redirection for Contact Form 7 plugin if feasible. Monitor official themeisle communications for updates or patches addressing this vulnerability.