CVE-2026-83592

Name of the Vulnerable Software and Affected Versions Contact Form DB for Enfold plugin for WordPress versions prior to 2.0.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs when field values are echoed unescaped within the admin/ecf index.php endpoint, specifically inside a title HTML attribute and the table cell body. Base64 encoding and serialization of the stored values fail to neutralize the malicious content, allowing scripts to execute when a user accesses the affected page.

Recommendations Update the plugin to a version newer than 2.0.2.