EUVD-2026-50094
GHSA-5j37-75mq-f752
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
PR:L reflects mandatory contributor authentication; S:C and UI:N model stored XSS executing in any visiting user's browser without additional interaction.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Contact Form to Any API WordPress plugin (versions ≤ 3.0.6) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts via the cf7anyapi_form_field post meta field. Any user who subsequently loads a page containing the injected content will silently execute the attacker's script within their browser session, potentially exposing session tokens or enabling unauthorized actions. No active exploitation is confirmed - CISA KEV status is absent, EPSS sits at the 9th percentile (0.19%), and SSVC classifies exploitation as 'none' - indicating this is a low-urgency but real risk for multi-author WordPress deployments.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied data written to the cf7anyapi_form_field WordPress post meta key is neither sanitized on input nor escaped on output. Three specific code paths in the plugin's admin class (class-cf7-to-any-api-admin.php at approximately lines 334, 519, and 604 per the WordPress Trac references) are implicated. The CVSS Scope:Changed metric reflects the fundamental nature of stored XSS - the vulnerable component (the plugin's admin backend) stores the payload, but impact materializes in a distinct security context (the victim's browser session), where attacker-controlled JavaScript executes under the victim's origin trust. This scope change is what elevates the score above a simple content-injection issue and is the mechanism by which an attacker can escalate privilege or pivot through administrative sessions.
RemediationAI
A code fix has been committed to the WordPress plugin repository as evidenced by the Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3624000%40contact-form-to-any-api&new=3624000%40contact-form-to-any-api; however, an exact patched release version number is not independently confirmed from the available data - consult the plugin's changelog on WordPress.org and update to any version released after 3.0.6. If immediate update is not possible, a compensating control is to restrict contributor-level role assignments to fully trusted users only, since the attack requires that privilege level; removing untrusted contributor accounts eliminates the attack surface. WordPress sites using a Web Application Firewall such as Wordfence (which disclosed this issue) may benefit from existing XSS ruleset coverage as a temporary compensating measure, though this should not substitute for patching. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5390b1-c85b-4bf6-ab38-6ae0efe72ffa should be monitored for updated patch confirmation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today