What is the CVSS score of CVE-2026-57411?

CVE-2026-57411 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of CF7 Views are affected by CVE-2026-57411?

CF7 Views, a WordPress plugin for Contact Form 7, contains a DOM-based cross-site scripting vulnerability (CVE-2026-57411) affecting all versions through 3.2.2 that allows attackers to execute…

How to fix or mitigate CVE-2026-57411?

Within 24 hours, inventory all WordPress installations running CF7 Views plugin versions 3.2.2 and earlier and assess current deployments. Within 7 days, either deactivate and remove the vulnerable plugin across affected sites or implement Web Application Firewall (WAF) rules to block suspicious requests to the plugin; notify affected users of the vulnerability and expected remediation timeline. Within 30 days, monitor Patchstack and vendor advisories for security updates; if no patch is released, evaluate alternative Contact Form 7 extensions or implement enhanced compensating controls including Content Security Policy (CSP) headers and HTTP security headers.

CF7 Views CVE-2026-57411

EUVD-2026-43483 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Cf7 Views 8211 Complete Entry Management For Contact Form 7 Aman

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered DOM XSS needing victim interaction (UI:R) and no attacker auth (PR:N); script escapes the component context (S:C) with limited C/I/A impact in the browser.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:56 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views – Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views – Complete Entry Management for Contact Form 7: from n/a through <= 3.2.2.

AnalysisAI

DOM-based cross-site scripting in the WordPress plugin CF7 Views - Complete Entry Management for Contact Form 7 (by Aman) affects all versions from an unspecified start through 3.2.2, letting a remote attacker who lures a user into interacting with a crafted link or page execute arbitrary JavaScript in that user's browser session. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change (S:C), reflecting that script executes outside the vulnerable component's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed via Patchstack.

Technical ContextAI

The affected component is a WordPress plugin that extends Contact Form 7 to display and manage form submission entries within WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-based variant, meaning untrusted data reaches a client-side sink (such as innerHTML, document.write, or a JavaScript-driven rendering routine) without proper encoding, so the malicious payload is assembled and executed entirely in the victim's browser rather than being reflected by the server. The single CPE, cpe:2.3:a:aman:cf7_views_–_complete_entry_management_for_contact_form_7:*, identifies the vendor as 'aman' and covers all versions up to and including 3.2.2. Because it is DOM-based, exploitation depends on how the plugin's front-end JavaScript handles URL parameters, fragment identifiers, or stored entry data when rendering views.

RemediationAI

No vendor-released patch version is identified in the available data; the advisory records the vulnerable range as up to and including 3.2.2, so administrators should monitor the plugin page and the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/cf7-views/vulnerability/wordpress-cf7-views-complete-entry-management-for-contact-form-7-plugin-3-2-2-cross-site-scripting-xss-vulnerability) and upgrade to any release above 3.2.2 as soon as one is published. Until a fixed version is confirmed, compensating controls include deactivating and removing the CF7 Views plugin if entry-management views are not business-critical (trade-off: loss of submission-management UI), placing the WordPress admin and any pages that render CF7 Views output behind a Web Application Firewall with XSS filtering or a virtual patch (Patchstack/Wordfence offer this; trade-off: possible false positives on legitimate rich content), and enforcing a strict Content-Security-Policy that disallows inline script execution to blunt DOM-based payloads (trade-off: may break other plugins relying on inline JS). Restrict access to entry-view pages to trusted authenticated users where feasible.