EUVD-2026-93253
GHSA-9prw-jw8p-fhcv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Database for CF7 ≤1.2.6
-
DeliverySubmit crafted form input with XSS payload
-
ExploitPayload stored/reflected unsanitized
-
ExecutionAdmin views submissions page
-
PersistScript executes in admin browser session
-
ImpactSteal session cookies or perform admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the 'Database for CF7' WordPress plugin at version 1.2.6 or earlier, which stores and displays Contact Form 7 submission data. No authentication is required for the attacker (PR:N), but successful code execution REQUIRES user interaction (UI:R) - a victim, most likely an administrator viewing the stored form-submission data in the plugin's interface, must load the page containing the unsanitized payload. Limiting factors: the plugin must be installed and active, an attacker must be able to reach a form/input that the plugin persists or reflects, and the payload only executes when a user renders the affected view, so exploitation is not fully automatic against an unattended server. |
| Impact | This is a moderate-severity (CVSS 7.1) unauthenticated reflected/injected Cross-Site Scripting flaw in the WordPress 'Database for CF7' plugin (vendor code4life) affecting versions <= 1.2.6, reported by Patchstack and classified CWE-79. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) indicates network-reachable, low-complexity exploitation with no privileges required but DOES require user interaction (UI:R) and reflects a changed scope (S:C) typical of XSS executing in a victim's browser context. No EPSS probability, CISA KEV listing, or public proof-of-concept is present in the supplied data, so this is not confirmed as actively exploited - it should be treated as a patch-and-move-on item rather than an emergency. The signals are internally consistent (no CVSS-versus-description conflict), but the single-source intelligence (Patchstack only) and absence of EPSS/KEV/POC data mean real-world exploitation pressure is currently unquantified. Net priority: real but low-to-moderate - prioritize behind internet-facing, authenticated-impact, or KEV-listed issues, while noting the unauthenticated nature means any WordPress site running the vulnerable plugin is a candidate target. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious payload (e.g. via a Contact Form 7 submission or a crafted URL parameter) containing JavaScript that the plugin stores or reflects without proper sanitization. When a victim - most plausibly a site administrator reviewing form submissions in the plugin's database view - loads the affected page, the script executes in their authenticated browser session, enabling session/cookie theft or admin actions. No public exploit code was identified at time of analysis, and successful execution depends on the required user interaction (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated cross-site scripting in the WordPress plugin Database for CF7 (vendor code4life) affects all versions up to and including 1.2.6, letting an attacker plant script that executes in the browser of a user - most likely an administrator reviewing stored Contact Form 7 submission data in the plugin's interface. Exploitation is remote and needs no attacker credentials (PR:N), but it does require victim interaction (UI:R) because the payload only fires when the affected page or submission view is rendered; the scope change (S:C) with limited confidentiality, integrity, and availability impact yields a CVSS 3.1 base score of 7.1. No public exploit code was identified and the flaw is not listed in CISA KEV at the time of analysis.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/database-for-cf7/vulnerability/wordpress-database-for-cf7-plugin-1-2-6-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for a fixed release and upgrade Database for CF7 immediately once one is published; until then, do not simply assume that a later version is patched. If the plugin's submission-storage feature is not required, deactivate and remove it - this eliminates the attack surface entirely but also discards or strands previously stored Contact Form 7 submission records, so export any needed data first. Where the plugin must stay, restrict the WordPress administrative dashboard (wp-admin) to trusted, patched, non-shared browsers and require administrators to avoid reviewing untrusted submissions while logged into a privileged session, since the exploit hinges on an admin loading the poisoned view. Deploy a WAF or reverse-proxy rule set that filters script-bearing payloads in POST bodies and query strings landing on the plugin's endpoints and WordPress form submissions, accepting that signature-based filtering is bypassable and requires ongoing tuning. Finally, apply output-encoding and Content-Security-Policy hardening at the theme or security-plugin layer to limit script execution in the admin origin - CSP can break legitimate admin JavaScript and should be rolled out in report-only mode before enforcement - and monitor WordPress admin access logs for anomalous requests tied to the plugin's pages while exposure remains.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-79 cross-site scripting weakness in a WordPress plugin that persists and displays Contact Form 7 submissions. Because the plugin stores form input and later renders it inside administrative views of the site, any user-controllable field that is stored or echoed back without context-appropriate output encoding can carry a script payload into the victim's browser session. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L confirms network reachability, low attack complexity, no privileges required for the attacker, and mandatory user interaction - the victim must load a page that renders the unsanitized data, which in practice is the plugin's submission listing or a related dashboard screen viewed by a logged-in administrator. The scope change (S:C) reflects that the injected script escapes the vulnerable plugin component and executes in the context of the broader WordPress admin origin, potentially enabling session or privilege abuse; the limited C/I/A ratings indicate the direct impact is constrained rather than full site compromise. The CPE record cpe:2.3:a:code4life:database_for_cf7:*:*:*:*:*:*:*:* uses a wildcard version, meaning the entire version lineage identified by the vendor is considered affected in this advisory, with 1.2.6 named as the highest known vulnerable release. Any exploitability is contingent on the plugin being installed and active and on the attacker having a path to submit input that the plugin later renders.
Know when Database For Cf7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable, no attacker auth (PR:N) but victim interaction needed (UI:R); XSS executes cross-context (S:C) with limited C/I/A impact in the victim browser session.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
Executive ViewAI
A high-severity cross-site scripting flaw in the WordPress plugin Database for CF7 (vendor code4life), affecting all versions through 1.2.6, lets an unauthenticated attacker plant script that executes in the browser of an administrator reviewing stored Contact Form 7 submissions. Because the compromised session belongs to a privileged site owner, exploitation could lead to full WordPress site takeover, data theft, or defacement of public-facing properties. No vendor-released patch is available, so affected organizations must rely on interim controls until a fixed version ships.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove Database for CF7 (all versions through 1.2.6) where feasible; restrict wp-admin access through IP allowlisting, VPN, or MFA; keep administrator accounts to a minimum; deploy WAF or virtual-patching rules filtering script payloads in Contact Form 7 submission fields; enforce a restrictive Content Security Policy on admin pages; monitor and sanitize stored submission data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB