Magic Tooltips CF7 EUVD-2026-91906

Requires a WordPress site running Magic Tooltips For Contact Form 7 version 1.0.34 or earlier with comment submission enabled (WordPress default). The attacker submits a comment containing an HTML-entity-encoded script in the 'author' name field; no authentication is needed for submission. The payload only executes when a privileged administrator opens the comment-moderation screen at wp-admin/edit-comments.php, where the plugin's esc_html callback decodes the entities into executable markup - this admin-view requirement is the key limiting factor. Comment moderation does NOT mitigate it, because pending/unapproved comments still render in the moderation queue the admin reviews.

CVSS 3.1 rates this 7.2 (High), driven by AV:N/AC:L/PR:N (unauthenticated, network, low complexity) plus S:C for scope change - an unauthenticated visitor's input executes in the authenticated administrator's browser context. However, several signals temper real-world urgency: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public exploit code was supplied, so exploitation status is 'no public exploit identified at time of analysis.' Applying an SSVC lens: exploitation is 'none' (no evidence in the wild), the attack is not readily automatable because a privileged administrator must view the comment-moderation queue before the payload fires, and technical impact is partial (C:L/I:L, no availability loss). A notable data nuance: the input vector lists UI:N, yet the description makes clear execution only occurs when an administrator views wp-admin/edit-comments.php - a privileged user action that argues for UI:R and a somewhat lower effective score. Net assessment: a legitimate stored-XSS admin-takeover risk worth patching promptly, but tempered to medium real-world priority by low product prevalence, the admin-view trigger, and the absence of exploitation or EPSS evidence.

An unauthenticated attacker submits a WordPress comment whose author-name field contains an HTML-entity-encoded script payload (e.g. using '<tip>'-style encoding); this passes sanitize_text_field because it is inert text at submission time. When a site administrator later opens the comment-moderation screen (wp-admin/edit-comments.php), the plugin's esc_html filter callback decodes the entities back into live HTML and the script executes in the administrator's authenticated session, enabling actions such as creating rogue admin accounts. No public proof-of-concept was provided in the intelligence sources; the low attack complexity (AC:L) and network vector (AV:N) make exploitation straightforward once an admin views the queue.