CVE-2026-13359

Name of the Vulnerable Software and Affected Versions Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress versions prior to 1.7.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. By submitting a contact form, an attacker can inject arbitrary web scripts via the cntctfrm contact dropdown parameter. These scripts execute within the context of an administrator's browser session when they access the message manager page at the '/wp-admin/admin.php?page=cntctfrmtdb manager' endpoint, potentially leading to the compromise of administrator-level sessions.

Recommendations Update the plugin to version 1.7.6 or later. As a temporary mitigation, restrict access to the '/wp-admin/admin.php?page=cntctfrmtdb manager' endpoint or avoid using the cntctfrm contact dropdown parameter until the update is applied.