CVE-2026-97661

Name of the Vulnerable Software and Affected Versions Business Essentials for Contact Form 7 versions prior to 1.2.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue affects the gateway form field and requires the Payments module to be enabled, with a form configured to accept both PayPal and Stripe as payment gateways.

Recommendations Update Business Essentials for Contact Form 7 to version 1.2.2 or later. As a temporary mitigation, disable the Payments module or restrict the use of the gateway form field.