CVE-2026-39731

HighCVSS 7.1

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

A vulnerability in the Database for CF7 plugin up to version 1.2.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).

Risk Assessment

An unauthenticated attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or other attacks.

Recommendation

Update the Database for CF7 plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Database for CF7

CVE-2026-13425High
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This is exploitable because Contact Form 7 accepts array-structured input for ordinary text fields via the public REST API endpoint, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom table, bypassing WordPress save-time filtering.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS