CVE-2024-2242

CVE-2024-2242 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Contact Form 7 plugin for WordPress, specifically versions up to and including 5.9. This flaw allows unauthenticated attackers to inject arbitrary web scripts through the 'active-tab' parameter due to insufficient input sanitization. The vulnerability carries a CVSS score of 6.1 (Medium) and requires user interaction, as an attacker must trick a user into clicking a malicious link to execute the script. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, its high EPSS and FAUCET Risk Score indicate a notable potential for future exploitation.