Form Vibes EUVD-2026-43147

Exploitation requires that the target WordPress site runs Form Vibes (≤1.5.2) with the Contact Form 7 integration enabled and a publicly reachable CF7 form whose submissions are captured to the database - the injection is delivered through that CF7 form field, so a working CF7 form wired into Form Vibes is the concrete prerequisite. The attacker needs no authentication and no privileges (PR:N) to submit the payload. The practical limiting factor is that the stored script only executes when a privileged user (an administrator or operator with access to the Form Vibes entries/dashboard) subsequently views the captured submission; the payload is dormant until then, so sites where entries are never reviewed, or where the CF7 integration is disabled, are not exploitable in practice.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2, High) reflects a network-reachable, low-complexity, unauthenticated injection with a scope change, consistent with stored XSS whose payload executes in the privileged admin context. One tension is worth flagging: the vector sets UI:N, yet stored XSS in an admin-only entries view realistically requires an administrator to open the submissions page for the payload to fire, so real-world exploitation is gated on that operator action even though the metric does not penalize it - this is Wordfence's standard scoring convention for stored XSS reachable by unauthenticated submitters. No EPSS score, KEV entry, or SSVC decision data was supplied, so exploitation-probability signals are absent; treat exploitation likelihood as unquantified rather than low. There is no evidence of active exploitation and no public POC referenced (no public exploit identified at time of analysis). Overall this is a genuine patch-promptly priority for internet-exposed WordPress sites running the plugin because it is unauthenticated and can lead to admin session/credential compromise, but impact is bounded (C:L/I:L, no availability impact) and contingent on an admin viewing malicious entries, making it high-but-not-critical rather than an emergency mass-exploitation scenario.

An attacker submits a public Contact Form 7 form on a site running Form Vibes, placing a JavaScript payload (for example an event-handler attribute or script tag) into a form field. Form Vibes stores the unsanitized value, and when a site administrator later opens the Form Vibes submissions view the payload executes in their authenticated browser session, enabling session/cookie theft, creation of a rogue admin account, or other actions in the admin context. No authentication is required to plant the payload, and no public POC is currently referenced.