Business Essentials CF7 EUVD-2026-90574

Exploitation requires a non-default configuration: the plugin's Payments module must be enabled AND a Contact Form 7 form must be configured to accept BOTH PayPal and Stripe as payment gateways simultaneously. Given that, the 'gateway' form field is injectable by an unauthenticated remote attacker (PR:N/UI:N) in versions ≤1.2.1, with the stored payload later executing when any user views the injected page. Limiting factors: the dual-gateway payments configuration is specific and unlikely to be the default for most installs, which substantially narrows the exploitable population; impact is confined to browser-context script execution (C:L/I:L, no availability impact). Patched in changeset 3713721 (versions after 1.2.1).

Signals are mixed and net out to low real-world priority despite the 7.2 'High' CVSS. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) scores highly largely because PR:N (unauthenticated) and S:C (scope change, typical of stored XSS that executes in other users' browser contexts) stack together; however, the impact sub-metrics are only C:L/I:L/A:N, reflecting limited script-driven impact rather than system compromise. No EPSS score was supplied, this CVE is not in CISA KEV, and no public exploit code was identified at time of analysis - so there is no evidence of active or automated exploitation. The decisive risk reducer is in the description itself: exploitation requires a specific non-default configuration (Payments module enabled AND a single form configured to accept BOTH PayPal and Stripe), which sharply narrows the exploitable population below what PR:N/AC:L alone would imply. Treat as a low-urgency, patch-on-cycle item: genuinely unauthenticated and network-reachable where the precondition holds, but gated by a narrow configuration and carrying only low confidentiality/integrity impact. No key signals conflict with the vector; the main caveat is the absence of EPSS/KEV/POC data, which is consistent with a newly disclosed, low-exploitation-interest plugin flaw.

On a site running this plugin with the Payments module enabled and a Contact Form 7 form set to accept both PayPal and Stripe, an unauthenticated attacker submits a crafted 'gateway' form field containing a malicious script payload. Because input is insufficiently sanitized and output is not escaped, the payload is stored and later rendered, executing in the browser of any user (including an administrator) who views the affected page. No public proof-of-concept was identified at time of analysis.