This vulnerability (CWE-79) in Ultimate Addons for Contact Form 7 versions up to 3.5.50 allows improper neutralization of input during web page generation, leading to cross-site scripting (XSS). The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with scope changed and impacts on confidentiality, integrity, and availability rated as low to low to low respectively. No patch or remediation details are provided in the available data.

An attacker with low privileges and requiring user interaction could exploit this vulnerability to execute arbitrary scripts in the context of the affected web application. This could lead to partial compromise of confidentiality, integrity, and availability of the application or user data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit user privileges and avoid interacting with untrusted inputs in the affected plugin. Monitor vendor channels for updates.