Is CVE-2021-47926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-47926 being exploited in the wild.

How severe is CVE-2021-47926?

Medium severity, with a CVSS score of 6.4, published 10 May 2026.

Is there a fix for CVE-2021-47926?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-47926 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-47926?

Check whether you run CodePeople Form2Email at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-47926: Form2Email Contact Form to Email stored XSS in form name field

CVE-2021-47926 · Severity: medium · CVSS 6.4 · Published 2026-05-10

Contact Form to Email is a WordPress plugin used to build and manage website contact forms. A security flaw allows an authorized user to inject malicious code into the name of a form. When an administrator or another staff member views the form management page, this code executes in their browser, potentially allowing the attacker to steal login credentials or take over administrative sessions.

Vendors: CodePeople.

Quick answers

Is CVE-2021-47926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-47926 being exploited in the wild.
How severe is CVE-2021-47926?: Medium severity, with a CVSS score of 6.4, published 10 May 2026.
Which products and versions are affected?: CodePeople Form2Email 1.3.24.
Is there a fix for CVE-2021-47926?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-47926 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-47926?: Check whether you run CodePeople Form2Email at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the Contact Form to Email plugin version 1.3.24 for WordPress. The vulnerability is located in the form creation component, specifically within the 'form name' field, which fails to properly neutralize script tags before storage and subsequent display. An authenticated attacker with permissions to create or edit forms can inject arbitrary JavaScript. This code executes in the context of any user (such as an administrator) who visits the form management dashboard. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or credential theft. A public proof-of-concept exploit has been disclosed.

Affected products

Form2Email (CodePeople) Contact Form to Email 1.3.24

Timeline

2021-11-11: disclosed: Vulnerability discovered and exploit authored
2021-11-15: other: Exploit published to Exploit-DB
2026-05-10: advisory: CVE published/updated via VulnCheck and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.