CF7 Views EUVD-2026-89939

Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (PR:L) on a site running CF7 Views <= 3.2.5, plus a higher-privileged victim who must view the attacker's injected content (UI:R). It is not remotely exploitable by an unauthenticated attacker, and the scope-change impact (script executing in the victim's authenticated session) only materializes when a privileged user renders the malicious view/entry. Limiting factors: mandatory low-privilege authentication, required social-engineering/user interaction, dependency on the plugin being installed and active, and only low-magnitude C/I/A impact rather than direct site compromise.

This is a stored/contributor-level XSS (CWE-79) in the CF7 Views WordPress plugin (<= 3.2.5), reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, 6.5 Medium) indicates a network-reachable, low-complexity flaw that requires an authenticated low-privilege account (PR:L, consistent with a WordPress Contributor role) and victim interaction (UI:R). The scope change (S:C) reflects script execution crossing from the plugin/application into the victim's browser context. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The realistic priority is LOW-to-MEDIUM: exploitation is gated behind holding a Contributor account and social-engineering an admin/editor into viewing the malicious content, and impact is limited (C:L/I:L/A:L) rather than full site takeover. There are no conflicting signals in the data - the CVSS vector, description ('Contributor Cross Site Scripting'), and CWE-79 are mutually consistent. The main missing signals are EPSS and any exploit maturity indicator, which are simply absent rather than contradictory.

An attacker who has registered or obtained a low-privileged WordPress Contributor account on a site running CF7 Views <= 3.2.5 injects a malicious JavaScript payload into a plugin-controlled field (e.g. a form view/entry configuration). When a higher-privileged user such as an administrator later opens the affected view or entry-management page, the stored script executes in their authenticated browser session. No public POC was referenced, and success depends on the victim viewing the crafted content (UI:R).