CVE-2026-40807

HighCVSS 7.1

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The CF7 Views – Complete Entry Management for Contact Form 7 plugin in versions up to 3.2.6 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

Risk Assessment

An attacker can inject malicious script that executes in the user's browser, potentially leading to session or data theft. The risk affects all installations of the plugin version 3.2.6 and earlier.

Recommendation

Update the CF7 Views plugin to the latest version that does not contain the vulnerability. If updating is not possible, consider disabling the plugin until it is fixed.

Other vulnerabilities in CF7 Views – Complete Entry Management for Contact Form 7

CVE-2026-57411High
The CF7 Views – Complete Entry Management for Contact Form 7 plugin up to version 3.2.2 contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS