CF7 Views CVE-2026-40807

Exploitation targets the CF7 Views - Complete Entry Management for Contact Form 7 plugin (versions <= 3.2.6) where attacker-controlled input is reflected/rendered without proper sanitization or output encoding. Per the CVSS vector, no authentication is required (PR:N), but exploitation is LIMITED by mandatory user interaction (UI:R): a victim must click a crafted link or load attacker-influenced content for the injected script to execute in their browser session. Impact is further bounded to the WordPress site origin and the privileges of the victim's session - maximal damage requires socially engineering a privileged (administrator) user. The precise injectable parameter or view endpoint is not detailed in the provided data; consult the Patchstack advisory for the exact affected feature.

This is a moderate-severity, unauthenticated reflected/DOM Cross-Site Scripting flaw (CWE-79) in the CF7 Views WordPress plugin at or below version 3.2.6, reported by Patchstack. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates network-reachable, low-complexity, unauthenticated exploitation that nonetheless REQUIRES user interaction (UI:R) - a victim must click a crafted link or load attacker-influenced content - which is typical for reflected XSS and meaningfully lowers real-world exploitability versus a no-interaction bug. The scope-change (S:C) and Low C/I/A impacts reflect that injected script executes in the victim's browser session against the WordPress origin rather than directly compromising the server. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is NO signal of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuine but not emergency-priority issue - real risk is gated on social-engineering a user (ideally an administrator for maximum impact) and the plugin's relatively limited deployment footprint. Patch promptly in standard maintenance cycles rather than as a break-glass emergency, absent new exploitation evidence.

An attacker crafts a URL or form input containing a malicious JavaScript payload targeting the CF7 Views entry-management interface and lures a logged-in site user or administrator into opening it. When the victim's browser renders the unsanitized content, the script executes in the WordPress origin, enabling session/cookie theft, actions on behalf of the victim, or injection of further content. No public proof-of-concept was identified in the provided data, and successful exploitation depends on the required user interaction.