All vulnerabilities
CVE-2026-111574

Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox

Unknown Redirection for Contact Form 7
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.2.12Fixed versionCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 3.2.12Redirection for Contact Form 7CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.

Text from CVE List

Affected versions 1

  • Redirection for Contact Form 7affected: 2.2.7 before 3.2.12CVE List

References 1