CVE-2026-111574

Name of the Vulnerable Software and Affected Versions Redirection for Contact Form 7 versions 2.2.7 through 3.2.11

Description Stored Cross-Site Scripting (XSS) occurs because the plugin fails to sanitize or escape submitted form data stored as lead entries before displaying it in the lead debug metabox. This allows unauthenticated attackers to store malicious scripts that execute when a logged-in user views the entry while debug mode is enabled.

Recommendations Update Redirection for Contact Form 7 to version 3.2.12 or later. As a temporary mitigation, disable the debug mode to prevent the execution of stored scripts in the lead debug metabox.