CVE-2026-83592

Deferred Deferred - Pending Action

Stored XSS in Contact Form DB WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Wordfence

Description

The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-83592

EUVD

EUVD-2026-100795

Affected Vendors & Products

Vendor	Product	Version / Range
doctorwp	Contact	Form DB for Enfold 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Contact Form DB for Enfold WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via contact form field values due to insufficient input sanitization and output escaping. The injected scripts execute when users access affected pages, as the payload is echoed unescaped in both title attributes and table cells.

Detection Guidance

Check if the Contact Form DB for Enfold plugin version 2.0.2 or lower is installed. Inspect admin/ecf_index.php for unescaped output in title attributes or table cells. Look for base64 encoded or serialized malicious payloads in stored form field values.

Impact Analysis

Unauthenticated attackers could steal user sessions, redirect users to malicious sites, or deface your website. Users visiting infected pages may have their data compromised, and your site's reputation could suffer. Admin users viewing affected pages in the plugin interface may also be exposed to the malicious scripts.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. If exploited, it may result in unauthorized access to personal or sensitive information, triggering compliance violations, legal penalties, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Update the Contact Form DB for Enfold plugin to the latest version. If an update is unavailable, consider disabling or removing the plugin. Implement input sanitization for form fields and output escaping in admin/ecf_index.php.

Hi! I’m here to help you understand CVE-2026-83592. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70