This vulnerability (CVE-2026-66639) is a contributor-level cross-site scripting (CWE-79) issue in WPZOOM Forms – Contact Form Plugin for Gutenberg, affecting versions up to 2.0.4. It arises from improper input neutralization during web page generation, enabling an attacker with contributor privileges to inject malicious scripts that can execute in the context of other users. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at contributor level, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with contributor privileges to execute arbitrary scripts in the context of other users, potentially leading to partial disclosure of information, modification of data, or disruption of availability within the affected application context. The impact is limited by the requirement for contributor-level privileges and user interaction.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, limit contributor privileges to trusted users and monitor for suspicious activity related to the plugin.