Contact Form Email CVE-2026-112379

Exploitation requires the attacker to get a script payload persisted through the Contact Form to Email plugin (via a form submission field or form configuration) in versions up to and including 1.3.68, and then requires a victim - most plausibly an administrator reviewing submissions in wp-admin - to view the stored content for the payload to execute (UI:R). Limiting factors: the stored payload only fires on victim page view (not automatic), impact is confined to the victim's browser session (no server-side code execution), and the exact privilege level needed to persist the payload is not confirmed in the available data - if injection is only possible by an authenticated user, real-world risk is lower than the PR:N metric suggests. The plugin must be installed and active on the target WordPress site.

This is a moderate-severity stored XSS (CVSS 7.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) in the CodePeople 'Contact Form to Email' WordPress plugin, reported by Patchstack. The vector indicates network-reachable, low-complexity exploitation with no privileges, but it requires user interaction (UI:R) - consistent with a stored payload that fires when a victim (typically an administrator reviewing submissions) later views the affected page. The scope change (S:C) reflects script executing in the victim's browser context. No EPSS score, KEV listing, or POC was provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - exploitation probability cannot be quantified. There is a notable tension: PR:N implies unauthenticated injection (plausible if the payload enters via public contact-form fields rendered unsanitized in the admin dashboard), yet stored XSS in many plugins instead requires an authenticated contributor/admin to persist the payload - the input does not confirm which, so the privilege precondition should be verified against the Patchstack advisory. Overall this is a real but second-tier priority: the impact is limited (C:L/I:L/A:L, no direct RCE or data-exfiltration-at-scale), it depends on victim interaction, and there is no evidence of active exploitation. Patch or update promptly, but it does not warrant emergency out-of-band response absent new exploitation signals.

An attacker submits a contact form (or edits a form configuration) injecting a malicious script payload into a field that the plugin stores and later renders without proper neutralization. When an administrator subsequently views the stored submission or the affected page in wp-admin, the script executes in their authenticated browser session, enabling session theft, admin-action forgery, or content manipulation. No public exploit code was identified in the provided data, and successful execution depends on the victim viewing the tainted content (UI:R).