CVE-2026-13425

Received Received - Intake

Stored XSS in Database for CF7 WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because Contact Form 7 accepts array-structured input for ordinary text fields (e.g., your-name[]) via the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom wp_cf7db table, bypassing WordPress save-time filtering via wp_insert_post/wp_kses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-13425

EUVD

EUVD-2026-50198

Affected Vendors & Products

Vendor	Product	Version / Range
wordfence	database_for_cf7	to 1.2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Database for CF7 WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages by exploiting insufficient input sanitization and output escaping in array form field values. The plugin stores this data in a custom database table, bypassing WordPress's built-in security filters.

Detection Guidance

Check WordPress sites using the Database for CF7 plugin up to version 1.2.6 for stored XSS via array form field values. Inspect the wp_cf7db table for suspicious serialized data in the wp_posts or wp_options tables. Review REST API logs for POST requests to /wp-json/contact-form-7/v1/contact-forms/{id}/feedback with array-structured input.

Impact Analysis

Unauthenticated attackers could inject scripts that execute whenever users access infected pages. This could lead to theft of user sessions, credentials, or sensitive data, defacement of websites, or redirection to malicious sites. Users with admin access could further compromise the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to protect user data adequately.

Mitigation Strategies

Update the Database for CF7 plugin to the latest version. Implement input sanitization for form fields and validate REST API submissions. Use WordPress security plugins to filter malicious scripts. Monitor for unauthorized changes in the wp_cf7db table.

Hi! I’m here to help you understand CVE-2026-13425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70