CF7 Views CVE-2026-57411

Exploitation requires that the target site runs CF7 Views (cf7-views) version 3.2.2 or earlier and that a victim's browser reaches the plugin's vulnerable DOM rendering path - for example by visiting an attacker-supplied URL, fragment, or a page containing attacker-controlled entry data that the plugin's front-end JavaScript renders without sanitization. The mandatory limiting factor is user interaction (CVSS UI:R): the attack does not fire automatically or server-side but only when a user opens or interacts with the crafted content. No authentication is required of the attacker (PR:N), but the payload's usefulness is greatest when the interacting victim is a privileged WordPress user, and exploitation depends on the plugin being installed and active (a non-default component, not core WordPress).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates network-reachable, low-complexity exploitation requiring no privileges but mandating user interaction, with limited confidentiality, integrity, and availability impact amplified by a scope change. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified from this data. There is no KEV listing and no evidence of a public POC, so this is a real but not urgent issue: typical of Patchstack-catalogued WordPress plugin XSS, the realistic impact is session hijacking or admin-context script execution against a limited install base rather than mass automated compromise. The UI:R requirement (a victim must click or visit attacker-controlled content) is the main practical brake on exploitation, keeping this below the priority of an unauthenticated, no-interaction RCE despite the 'High' rating.

An attacker crafts a URL or a page containing a malicious script payload that the CF7 Views front-end JavaScript will process into a DOM sink, then delivers it to a logged-in site administrator or user via email, comment, or a link. When the victim opens the crafted content and the vulnerable view renders, the script executes in their browser, potentially stealing session cookies or performing actions in the WordPress context. No public POC is currently identified, so an attacker would need to develop the payload against the plugin's client-side rendering logic.