Contact Form DB for Enfold CVE-2026-83592

Requires an active install of the Contact Form DB for Enfold plugin (≤2.0.2) with at least one Enfold contact form collecting submissions. An attacker submits a crafted payload through the public-facing form with no authentication; the value is persisted (base64 encoding and serialization of stored values do NOT neutralize the payload). Execution is LIMITED by requiring a logged-in user - in practice an administrator - to subsequently open the form-entries admin page (admin/ecf_index.php), where the value is rendered unescaped both in a title attribute and the table cell body. No special non-default configuration is needed beyond the plugin being installed and submissions being viewed by a privileged user.

CVSS 3.1 base score is 7.2 (High) driven by AV:N/AC:L/PR:N/UI:N with a scope change (S:C) and Low confidentiality/integrity impact. The network, no-privilege, no-UI metrics make the injection step trivial and unauthenticated. However, the description itself clarifies this is a STORED XSS whose payload 'will execute whenever a user accesses an injected page' (admin/ecf_index.php) - i.e. realistic impact depends on a logged-in administrator opening the form-entries view, which the CVSS UI:N metric does not reflect. This is a genuine but second-order risk: injection is unauthenticated and easy, yet actual code execution is gated on admin interaction, so the practical effect is admin-session XSS rather than direct server compromise (A:N, no availability impact). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no public exploit identified at time of analysis. Net assessment: a legitimately exploitable stored XSS worth patching, but more likely opportunistic/targeted than mass-exploited given the niche affected plugin and the admin-view trigger - not a drop-everything emergency absent evidence of active exploitation.

An unauthenticated attacker submits a WordPress Enfold contact form, placing a script payload in a field value. The value is stored and later echoed unescaped - both inside a title HTML attribute and in the table cell body - in the admin entries page (admin/ecf_index.php), so when a site administrator opens the submissions view the script executes in their authenticated browser session. No public exploit code is known, but the low attack complexity and unauthenticated injection make the delivery step trivial.