Is CVE-2026-13359 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13359 being exploited in the wild.

How severe is CVE-2026-13359?

High severity, with a CVSS score of 7.2, published 9 September 2026.

Which products and versions are affected?

BestWebSoft Contact Form to DB up to and including 1.7.5.

Is there a fix for CVE-2026-13359?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13359 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13359?

Check whether you run BestWebSoft Contact Form to DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13359: BestWebSoft Contact Form to DB stored XSS in message parameter

CVE-2026-13359 · Severity: high · CVSS 7.2 · Published 2026-09-09

The Contact Form to DB plugin for WordPress, used to collect and store contact form submissions in a database, contains a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can inject malicious scripts through the contact form that execute whenever administrators view submitted messages, potentially allowing compromise of admin accounts.

Vendors: BestWebSoft.

Quick answers

Is CVE-2026-13359 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13359 being exploited in the wild.
How severe is CVE-2026-13359?: High severity, with a CVSS score of 7.2, published 9 September 2026.
Which products and versions are affected?: BestWebSoft Contact Form to DB up to and including 1.7.5.
Is there a fix for CVE-2026-13359?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13359 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13359?: Check whether you run BestWebSoft Contact Form to DB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Stored XSS (CWE-79) in the cntctfrm_contact_dropdown parameter caused by insufficient input sanitization and output escaping. The plugin fails to properly sanitize user-supplied input from contact form submissions and does not escape output when displaying messages in the admin panel at /wp-admin/admin.php?page=cntctfrmtdb_manager. An unauthenticated attacker can submit a contact form with malicious JavaScript payload, which is stored in the database and executed in the administrator's browser session when they access the message manager page, enabling session hijacking or privilege escalation attacks. The vulnerability affects all versions up to and including 1.7.5.

Affected products

BestWebSoft Contact Form to DB up to and including 1.7.5

Timeline

2026-09-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.