The CVSS 6.4 and EPSS 0.00156 for this stored XSS in a Contact Form 7 extension (Ultra Addons' Range Slider component) flatter to deceive. The vulnerability allows contributor-level users to inject persistent scripts through data-label and data-separator attributes—scripts that execute on any visitor viewing those pages, not just admins reviewing drafts.
The asymmetric risk here is the combination of low access threshold with high impact. Contributor is one of the most commonly over-granted WordPress roles—guest authors, content agencies, and contractors routinely get this access because proper permission scoping is cognitive overhead most teams skip. A compromised contributor account is often easier to obtain than an admin account (social engineering, credential stuffing), yet this stored XSS transforms that low-privilege foothold into code execution on every page visitor.
Three things you should do now: audit who in your WordPress environment holds contributor access and whether they genuinely need it; if you use this specific extension, treat any unpatched version as equivalent to having a backdoor on contributor accounts; and examine your plugin inventory for abandoned or infrequently updated extensions that extend trusted plugins like CF7—these create supply chain exposure that CVSS alone cannot quantify.
The temporal window matters more than the EPSS score suggests. An attacker with contributor access doesn't need to wait for CVE disclosure—they can exploit this silently during the draft-review cycle before any patch exists. EPSS models vulnerability probability at disclosure time, not pre-disclosure exploitability. In plugin ecosystems with slow remediation cycles, that gap favors patient attackers.