CVE-2026-97661 is a stored cross-site scripting vulnerability in the Business Essentials for Contact Form 7 plugin for WordPress. The flaw exists in the 'gateway' form field due to improper neutralization of input during web page generation, allowing injection of arbitrary web scripts that execute when a user accesses the affected page. The vulnerability affects all versions up to and including 1.2.1 and requires the Payments module to be enabled with a form configured for both PayPal and Stripe gateways.

An unauthenticated attacker can inject malicious scripts that execute in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and scope change.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor's advisory or plugin updates regularly for a fix. Until a patch is available, disabling the Payments module or avoiding configuration of forms that accept both PayPal and Stripe gateways may reduce exposure. Monitor vendor channels for remediation updates.