CVE-2026-15735
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7anyapi_form_field' Post Meta in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping.
Risk Assessment
Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user visits an injected page.
Recommendation
Update the plugin to the latest version immediately and apply proper security filters for meta fields.
Other vulnerabilities in Contact Form to Any API
See all- CVE-2026-18946High
The Contact Form to Any API plugin before version 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
- CVE-2026-39449High
Versions of Contact Form to Any API <= 3.0.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
Original NVD description (English source)
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.