Executive brief
The Contact Form to DB plugin for WordPress, used to collect and store contact form submissions in a database, contains a stored cross-site scripting (XSS) vulnerability. Unauthenticated attackers can inject malicious scripts through the contact form that execute whenever administrators view submitted messages, potentially allowing compromise of admin accounts.
Technical details
The vulnerability is a Stored XSS (CWE-79) in the cntctfrm_contact_dropdown parameter caused by insufficient input sanitization and output escaping. The plugin fails to properly sanitize user-supplied input from contact form submissions and does not escape output when displaying messages in the admin panel at /wp-admin/admin.php?page=cntctfrmtdb_manager. An unauthenticated attacker can submit a contact form with malicious JavaScript payload, which is stored in the database and executed in the administrator's browser session when they access the message manager page, enabling session hijacking or privilege escalation attacks. The vulnerability affects all versions up to and including 1.7.5.
Affected products
- BestWebSoft Contact Form to DB up to and including 1.7.5
Timeline
- 2026-09-09: disclosed