CVE-2025-9562

MediumCVSS 6.4

Published: 18/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

The Redirection for Contact Form 7 plugin for WordPress up to version 3.2.6 is vulnerable to Stored Cross-Site Scripting via the qs_date shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an injected page.

Risk Assessment

An attacker can inject malicious scripts that execute in users' browsers, potentially leading to session theft, account takeover, or malware distribution.

Recommendation

Update the Redirection for Contact Form 7 plugin to the latest patched version. Additionally, restrict user permissions to the minimum necessary.

Other vulnerabilities in Redirection for Contact Form 7

CVE-2026-23970High
Versions of Redirection for Contact Form 7 up to 3.2.8 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Original NVD description (English source)

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS