CVE-2026-39449
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Versions of Contact Form to Any API <= 3.0.3 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts.
Risk Assessment
This vulnerability may lead to user data theft or session hijacking, posing a serious threat to the application's security and the organization's data.
Recommendation
It is recommended to upgrade to the latest version of Contact Form to Any API to mitigate this vulnerability and implement additional security measures against XSS attacks.
Other vulnerabilities in Contact Form to Any API
See all- CVE-2026-18946High
The Contact Form to Any API plugin before version 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
- CVE-2026-15735Medium
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7anyapi_form_field' Post Meta in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.