CVE-2026-111574
Deferred Deferred - Pending Action

Stored XSS in Redirection for Contact Form 7 WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-111574
EUVD
EUVD-2026-107072

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Redirection for Contact Form 7 2.2.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the Redirection for Contact Form 7 WordPress plugin versions 2.2.7 to 3.2.11. Attackers can inject malicious scripts into form data stored as lead entries without authentication. When a logged-in user views the infected entry with debug mode enabled, the script executes.

Detection Guidance

Check if the Redirection for Contact Form 7 plugin version is between 2.2.7 and 3.2.11. Inspect lead entries for suspicious scripts in the Lead Debug Metabox when debug mode is enabled. Look for unauthenticated form submissions storing malicious payloads.

Impact Analysis

Unauthenticated attackers can store malicious scripts in form submissions. When a logged-in user views these entries with debug mode enabled, the script runs in their browser. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, exposing sensitive information and potentially leading to regulatory fines or penalties.

Mitigation Strategies

Update the Redirection for Contact Form 7 plugin to version 3.2.12 or later immediately. Disable the plugin's debug mode if enabled. Review stored lead entries for malicious scripts and remove any suspicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111574. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...