CVE-2026-57411

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The CF7 Views – Complete Entry Management for Contact Form 7 plugin up to version 3.2.2 contains a DOM-Based Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

Risk Assessment

An attacker can inject malicious client-side scripts, potentially leading to session theft, admin account takeover, or sensitive data leakage.

Recommendation

Immediately update the CF7 Views plugin to a version newer than 3.2.2 where the vulnerability is fixed.

Other vulnerabilities in CF7 Views – Complete Entry Management for Contact Form 7

CVE-2026-40807High
The CF7 Views – Complete Entry Management for Contact Form 7 plugin in versions up to 3.2.6 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views – Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views – Complete Entry Management for Contact Form 7: from n/a through <= 3.2.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS