Contact Form 7 – Dynamic Text Extension
Stored Cross-Site Scripting occurs due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. Authenticated attackers with Editor-level access and above can inject arbitrary web scripts that execute when an Administrator runs the scan feature. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.