CVE-2026-1045

Name of the Vulnerable Software and Affected Versions Viet contact plugin for WordPress versions prior to 1.3.3

Description The Viet contact plugin for WordPress is susceptible to Stored Cross-Site Scripting through the admin settings. This is due to inadequate input sanitization and output escaping. An authenticated attacker with administrator-level permissions can inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update the Viet contact plugin to version 1.3.3 or later.