Contact Form Entries CVE-2026-57708

Exploitation requires the victim to actively click or load an attacker-crafted URL against a site running Contact Form Entries <= 1.5.2 (CVSS UI:R), so it is not autonomous - a social-engineering step is mandatory. No authentication is needed to send the payload (PR:N), but impact is greatest when the clicking victim is an authenticated administrator viewing the plugin's pages, since the scope change (S:C) lets injected script act in that privileged browser context. Limiting factors: required user interaction, dependence on the victim's session/privilege level for meaningful impact, and the reflected (non-persistent) nature meaning each victim must be individually lured.

The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges, but requiring user interaction, with a scope change and low impact to confidentiality, integrity, and availability. The scope change and lack of required privileges push the score above a typical reflected-XSS rating, but the UI:R requirement (the victim must click a crafted link) meaningfully limits mass, unattended exploitation - this is a targeted/social-engineering vector, not a wormable one. No EPSS score was provided, no SSVC decision data was supplied, KEV status is negative, and no POC is referenced, so exploitation signals are all low or absent. Net assessment: a legitimate patch-worthy issue but not an emergency; prioritize behind actively exploited or unauthenticated-RCE items. Note the input lists A:L (availability impact) for an XSS, which is atypical - reflected XSS rarely affects availability; treat the A:L component as vendor-assigned rather than independently corroborated.

An attacker crafts a URL to the target WordPress site with a malicious script embedded in a parameter reflected by the Contact Form Entries plugin, then delivers it to a logged-in administrator via email or a link. When the admin opens the link, the script executes in their authenticated session, allowing session/cookie theft or admin actions on their behalf. No public POC is referenced, and the attack depends on the victim clicking the crafted link (UI:R).