CVE-2026-39745

HighCVSS 7.1

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

A vulnerability in the Contact Form to DB by BestWebSoft plugin up to version 1.7.6 allows an unauthenticated attacker to perform cross-site scripting (XSS).

Risk Assessment

An unauthenticated attacker can inject malicious scripts that execute in the user's browser, potentially leading to session theft, account takeover, or other attacks.

Recommendation

Update the Contact Form to DB plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Contact Form to DB by BestWebSoft

CVE-2026-13359High
The Contact Form to DB by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cntctfrm_contact_dropdown parameter in all versions up to and including 1.7.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. The payload executes in the context of an administrator's browser session when they visit the message manager page, potentially compromising administrator-level sessions.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS