What is the CVSS score of CVE-2026-57423?

CVE-2026-57423 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Message Filter For Contact Form 7 are affected by CVE-2026-57423?

Contact Form 7, a widely-deployed WordPress plugin, contains a reflected cross-site scripting vulnerability affecting versions through 1.6.3.8 that allows attackers to inject malicious code executed…

How to fix or mitigate CVE-2026-57423?

Within 24 hours: Disable the Contact Form 7 plugin and audit server access logs for exploitation attempts; if the plugin must remain active, implement Web Application Firewall (WAF) rules to block malicious payloads targeting the Message Filter parameter. Within 7 days: Inventory all WordPress installations using Contact Form 7 and document affected versions; identify and prepare replacement contact form solutions as contingency. Within 30 days: Upon vendor patch release for version 1.6.3.9 or later, deploy the update across all affected installations after testing in staging; alternatively, migrate to a patched alternative form plugin if vendor remediation remains unavailable.

Message Filter For Contact Form 7 CVE-2026-57423

EUVD-2026-43350 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Message Filter For Contact Form 7 Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:53 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter allows Reflected XSS.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.8.

AnalysisAI

Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin (versions up to and including 1.6.3.8) lets an attacker embed malicious script in a request parameter that is echoed back unsanitized, executing in the victim's browser when they follow a crafted link. Reported by Patchstack, the flaw carries a scope-changing CVSS 3.1 score of 7.1 and requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation yields limited confidentiality, integrity, and availability impact within the WordPress admin or visitor session context.