CVE-2026-101928

Name of the Vulnerable Software and Affected Versions Magic Tooltips For Contact Form 7 versions prior to 1.0.35

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue arises because the esc html filter callback decodes HTML-entity-encoded payloads back into live HTML. Consequently, a script payload submitted via the author parameter—which bypasses sanitize text field—is rendered as executable markup when an administrator accesses the 'wp-admin/edit-comments.php' endpoint.

Recommendations Update Magic Tooltips For Contact Form 7 to version 1.0.35 or later.