Executive brief
A vulnerability exists in a WordPress plugin used to store and manage contact form submissions. An attacker could trick a site administrator into clicking a malicious link, allowing the attacker to execute unauthorized code within the administrator's browser session. This could lead to unauthorized actions being performed on the website or the theft of sensitive administrative session information.
Technical details
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 'contact-form-entries' plugin due to insufficient sanitization and escaping of the 'form_id' parameter. The vulnerability occurs when the parameter is reflected into a JavaScript string literal within an inline <script> block on the 'vxcf_leads' admin page. An attacker can provide a crafted payload (e.g., using single quotes to break out of the string) that executes arbitrary JavaScript when a logged-in administrator visits the malicious link. This issue is fixed in version 1.5.3.
Affected products
- Unknown Database for Contact Form 7, WPforms, Elementor forms (contact-form-entries) < 1.5.3
Timeline
- 2026-07-07: disclosed: Publicly published by WPScan
- 2026-07-28: advisory: NVD published date
- 2026-07-28: patched: Fixed in version 1.5.3