What is the CVSS score of CVE-2026-57708?

CVE-2026-57708 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Contact Form Entries are affected by CVE-2026-57708?

The CRM Perks Contact Form Entries WordPress plugin (versions 1.5.2 and earlier) contains a reflected cross-site scripting flaw that could allow attackers to hijack administrator sessions and perform…

How to fix or mitigate CVE-2026-57708?

Within 24 hours, audit all WordPress installations for CRM Perks Contact Form Entries plugin version 1.5.2 or earlier and disable the plugin immediately. Within 7 days, implement Web Application Firewall rules to block XSS payloads targeting the plugin's contact form endpoints, and deploy Content Security Policy headers to restrict inline script execution in the WordPress admin interface. Within 30 days, monitor Patchstack and the plugin vendor for available patches; if a patch is released, apply it to all affected installations immediately. If no patch is released within 30 days, plan replacement with a maintained plugin providing equivalent contact form functionality.

Contact Form Entries CVE-2026-57708

EUVD-2026-43362 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Contact Form Entries Crm Perks

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network reflected XSS needs no privileges but requires the victim to click a link (UI:R); scope changes to the victim browser (S:C) with low C/I impact and no genuine availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:49 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks Contact Form Entries contact-form-entries allows Reflected XSS.This issue affects Contact Form Entries: from n/a through <= 1.5.2.

AnalysisAI

Reflected cross-site scripting in the CRM Perks "Contact Form Entries" WordPress plugin (versions up to and including 1.5.2) lets remote attackers inject script that executes in a victim's browser after the victim clicks a crafted link. Because the CVSS scope is changed (S:C), successful injection can reach data and actions beyond the vulnerable component, typically the WordPress admin/session context. No public exploit has been identified and it is not on CISA KEV; the flaw was reported by Patchstack.

Technical ContextAI

The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation). Contact Form Entries is a WordPress plugin that captures, stores, and displays submissions made through contact forms. Per the CPE (cpe:2.3:a:crm_perks:contact_form_entries), the affected component is the plugin's own code rather than WordPress core. The reflected variant means unsanitized request input (e.g. a GET/POST parameter or search value) is echoed back into an HTML response without proper output encoding, so an attacker-controlled value is rendered as executable markup in the response page rather than being persisted server-side.

RemediationAI

No vendor-released patched version is identified from the available data (the record only states the flaw affects versions up to and including 1.5.2). Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/contact-form-entries/vulnerability/wordpress-contact-form-entries-plugin-1-5-2-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin page for a release newer than 1.5.2, and upgrade as soon as one is published. Until then, apply compensating controls: deploy a WAF or Patchstack's virtual patch to filter reflected script payloads on the plugin's request parameters; restrict access to the plugin's admin/entries pages to trusted authenticated users via network or role controls; and set a restrictive Content-Security-Policy that disallows inline script to blunt reflected-XSS execution. Trade-offs: WAF rules can be bypassed by novel encodings and a strict CSP may break legitimate inline scripts used by the admin dashboard, so test before enforcing.