Contact Form to DB EUVD-2026-74566

The plugin Contact Form to DB by BestWebSoft must be installed and active on the WordPress site, and the associated contact form must be accessible to unauthenticated (anonymous) visitors - this is the default deployment. An administrator must subsequently visit the message manager page (/wp-admin/admin.php?page=cntctfrmtdb_manager) to trigger payload execution; exploitation is not spontaneous. No authentication, special network position, or non-default configuration is required to inject the payload. The limiting factor is the UI:R condition on the admin side: if administrators do not routinely review the message manager, payload dwell time extends but eventual triggering remains highly probable in normal operations.

The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) overstates exploitability on the UI metric. The payload only fires when an admin opens the message manager page - a UI:R condition - not spontaneously. With UI:R the score would drop to approximately 6.1 (Medium). Despite the corrected metric, real-world risk is meaningful: the attack chain requires only an anonymous form submission (zero barriers), and administrator session compromise is a reliable outcome once the admin checks their messages, which is routine. Scope change (S:C) is correctly applied because the XSS context crosses from the unauthenticated web tier into the authenticated admin session. No EPSS data was provided in the intelligence, and the CVE is absent from CISA KEV, so exploitation probability is inferred rather than measured. The trac changeset reference suggests a fix has been committed, reducing urgency for patched sites. The primary real-world risk is full WordPress admin account takeover on any unpatched site, from a completely unauthenticated starting position.

An anonymous attacker submits a contact form on the target WordPress site with a JavaScript payload embedded in the dropdown/select parameter (cntctfrm_contact_dropdown). The payload is stored unsanitized in the plugin's database table. When any site administrator later opens the Contact Form to DB message manager at /wp-admin/admin.php?page=cntctfrmtdb_manager to review submissions, the script executes in the admin's browser, enabling session cookie theft or creation of a rogue admin account. No exploit code repository was identified, but the attack requires only a standard HTTP POST to a public contact form.