CVE-2026-13425

Name of the Vulnerable Software and Affected Versions Database for CF7 versions prior to 1.2.7

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs because the software accepts array-structured input for ordinary text fields via the public REST API endpoint '/wp-json/contact-form-7/v1/contact-forms/{id}/feedback'. The plugin stores this submitted data using $wpdb INSERT with serialize() into a custom wp cf7db table, which bypasses standard WordPress save-time filtering functions like wp insert post() and wp kses(). Consequently, arbitrary web scripts can be injected into pages and executed when a user accesses them.

Recommendations Update to a version newer than 1.2.6.