Divi Contact Form 7
Monthly
The WordPress plugin Divi Contact Form 7 (slug cf7-styler-for-divi) through version 4.1.0 fails to neutralize script-related HTML tags in the output it renders, allowing content/script injection (CWE-80, basic XSS) with a CVSS 3.1 base score of 5.3. Only sites that run this styler plugin alongside the Divi theme and Contact Form 7 are exposed, and a successful attack requires injected markup to be rendered in a victim's browser. The vendor score asserts a network-reachable, unauthenticated attack with no user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), while the assessed vector instead requires authenticated access and victim interaction with changed scope (PR:L/UI:R/S:C), so the true privilege and interaction preconditions are not confirmed by the available sources. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is prioritized for remediation within the current monthly cycle rather than as an emergency.
The WordPress plugin Divi Contact Form 7 (slug cf7-styler-for-divi) through version 4.1.0 fails to neutralize script-related HTML tags in the output it renders, allowing content/script injection (CWE-80, basic XSS) with a CVSS 3.1 base score of 5.3. Only sites that run this styler plugin alongside the Divi theme and Contact Form 7 are exposed, and a successful attack requires injected markup to be rendered in a victim's browser. The vendor score asserts a network-reachable, unauthenticated attack with no user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), while the assessed vector instead requires authenticated access and victim interaction with changed scope (PR:L/UI:R/S:C), so the true privilege and interaction preconditions are not confirmed by the available sources. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is prioritized for remediation within the current monthly cycle rather than as an emergency.