Divi Contact Form 7 EUVD-2026-114270

The available sources do not name the specific field, form setting, or configuration that carries the payload, so the exact precondition is not described; the flaw lies in the plugin's failure to neutralize script-related HTML tags in rendered output. Exploitation is limited to deployments running Divi Contact Form 7 (cf7-styler-for-divi) at version 4.1.0 or earlier, which requires both the Divi theme and Contact Form 7 to be installed alongside this styler plugin. As a script-injection flaw, realistic exploitation depends on a victim rendering the injected content in their browser; the provided CVSS vector asserts PR:N/UI:N, but the required privilege level and whether victim interaction is needed are not confirmed by the evidence.

This is a medium-severity basic XSS / content-injection flaw (CWE-80) in the Divi Contact Form 7 (cf7-styler-for-divi) WordPress plugin, carrying a CVSS 3.1 base score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The real-world signals point to modest rather than urgent priority: no CISA KEV listing, no EPSS exploitation-probability figure supplied, and no public exploit or PoC referenced - the only source is a Patchstack database advisory. vuln.today assigns the Decision label 'this_month', consistent with a routine-patch cadence rather than emergency action. Two parts of the supplied CVSS vector are internally questionable and should be verified: for a script-injection (XSS) flaw, UI:N and I:N are atypical - XSS normally requires a victim to render the injected content (implying UI:R) and normally has an integrity impact in the victim's browser context, so the vendor-provided vector likely understates user interaction and overstates how 'hands-off' exploitation is. The trigger (which field/feature carries the payload, and whether any authentication is needed) is not described in the available sources. Net: a legitimate issue worth patching in a normal cycle, not a high-urgency, actively-exploited threat on current evidence.

An attacker places a crafted script payload into input that the plugin renders without proper neutralization; when a user or administrator subsequently views the page containing that unsanitized output, the script executes in their browser session. The exact injectable field and whether authentication is required are not described in the available sources. No public exploit identified at time of analysis.