EUVD-2026-93254
GHSA-3r82-vx58-5wrc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload
-
DeliveryDeliver via form submission or link
-
ExploitVictim views unsanitized content
-
ExecutionScript executes in victim browser
-
ImpactHijack session or perform admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Contact Form to DB by BestWebSoft WordPress plugin at version 1.7.6 or earlier; the attacker needs no authentication (PR:N) but DOES require victim user interaction (UI:R) - a user must load or render the attacker-controlled content for the injected script to execute, typically an administrator viewing stored form-submission data in the WordPress dashboard or a victim following a crafted link. The limiting factors are the mandatory user-interaction step and the fact that impact is confined to the victim's browser session (client-side script execution), not direct server compromise; sites not running this plugin or already updated beyond 1.7.6 are unaffected. |
| Impact | This is a reflected/stored Cross-Site Scripting flaw (CWE-79) in the WordPress plugin Contact Form to DB by BestWebSoft (<= 1.7.6), rated CVSS 7.1 by the reporting source. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity, unauthenticated exploitation that requires victim user interaction (UI:R) and crosses a scope boundary (S:C), consistent with XSS executing in a victim's browser session rather than compromising the server directly. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 7.1 is driven largely by the unauthenticated network vector and scope change, not by demonstrated real-world weaponization. The dependence on UI:R (a victim must load attacker-influenced content) meaningfully caps realistic impact versus a no-interaction flaw. Net: a legitimately patch-worthy medium-high issue for sites running this plugin, but absent KEV/EPSS/POC signals it is not an emergency; prioritize routine patching rather than incident-level response. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious link or form input containing a JavaScript payload that the plugin fails to sanitize. When an administrator or other user views the affected page (e.g., submitted form data in the WordPress admin), the script executes in their browser session, potentially stealing session cookies or performing admin actions. No public exploit code was identified at time of analysis, and successful exploitation depends on tricking a user into triggering the payload (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated cross-site scripting in the WordPress plugin Contact Form to DB by BestWebSoft (versions 1.7.6 and earlier) lets remote attackers inject arbitrary client-side script through contact-form handling, which then executes in the browser of a victim who loads or views the crafted or stored content. Exploitation requires no credentials (the reported vector is PR:N) but does depend on victim interaction (UI:R) - typically an administrator opening submitted form data in the WordPress dashboard or a user following a crafted link - so impact is confined to the victim's browser session rather than direct server compromise. Patchstack rates the issue CVSS 3.1 7.1; our independent assessment keeps the same base characteristics except availability (A:N) and confirms the required user-interaction step as the main limiting factor. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is confirmed in the available data; the referenced Patchstack advisory (https://patchstack.com/database/wordpress/plugin/contact-form-to-db/vulnerability/wordpress-contact-form-to-db-by-bestwebsoft-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve) should be monitored for a fixed release, and administrators should upgrade to the first version published after 1.7.6 as soon as it becomes available. Until then, the most effective compensating control is to deactivate and remove the plugin if its form-to-database functionality is not business-critical - this eliminates the attack surface entirely at the cost of losing stored submission handling. Where the plugin must stay active, restrict access to the WordPress admin area (IP allow-listing, mandatory strong authentication/2FA for administrator accounts) so that even injected payloads are seen only by trusted users; this reduces exposure but does not fix the underlying output-encoding defect. Deploying a WAF or virtual-patching rule that filters script payloads on the plugin's form and entry-viewing endpoints offers interim protection but is signature-dependent and bypassable. A restrictive Content-Security-Policy can blunt script execution in the admin origin, though it may break legitimate dashboard JavaScript and should be tested before rollout. Finally, ensure any shortcodes or submission-listing pages are not exposed to unauthenticated or low-privileged visitors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in the WordPress plugin Contact Form to DB by BestWebSoft, which persists contact-form submissions into the WordPress database for later review in the admin dashboard. Because user-supplied form field values are not adequately escaped/sanitized when the stored entries are rendered back into HTML, an unauthenticated attacker can seed markup that a browser later interprets as script. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C indicates a network-reachable, low-complexity attack needing no authentication but requiring the victim to load the affected page; the scope-change (S:C) element reflects that the injected script executes inside the privileged WordPress admin origin, in principle allowing actions under the victim's session context. The impact sub-scores are limited (C:L/I:L and A:N in our assessment), so the realistic effect is session-scoped data theft or defacement/redirect within the browser rather than full site takeover. CPE data (cpe:2.3:a:bestweblayout:contact_form_to_db_by_bestwebsoft:*:*) uses a wildcard and does not pin versions, so the authoritative version ceiling comes from the product description at 1.7.6 and earlier.
Know when Contact Form To Db By Bestwebsoft gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-reachable XSS requiring victim interaction (UI:R) with a scope change into the browser (S:C); limited confidentiality/integrity impact and no availability impact, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
Executive ViewAI
Contact Form to DB by BestWebSoft, a WordPress plugin used to capture and display form submissions, exposes organizations running versions 1.7.6 and earlier to unauthenticated cross-site scripting that can execute in an administrator's browser when submitted form content is viewed. Although exploitation requires a victim to interact with crafted or stored content and does not directly compromise the server, a successful attack could hijack an authenticated dashboard session and lead to unauthorized site changes. Leadership should care because affected WordPress sites may be publicly reachable and no vendor patch is currently available, so risk must be managed through interim controls.
No vendor-released patch identified at time of analysis; deactivate or remove Contact Form to DB by BestWebSoft versions 1.7.6 and earlier, restrict WordPress dashboard access via IP allowlist/VPN, enforce MFA, deploy WAF/virtual patching for XSS, and monitor form submissions and admin sessions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB