CVE-2026-57423
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Message Filter for Contact Form 7 WordPress plugin is vulnerable to Reflected Cross-site Scripting (XSS) in versions up to and including 1.6.3.8. An attacker can inject malicious scripts due to improper input neutralization during page generation.
Risk Assessment
The risk involves potential execution of arbitrary JavaScript in the victim's browser, which could lead to session hijacking, malicious redirects, or credential theft.
Recommendation
Immediately update the Message Filter for Contact Form 7 plugin to a version newer than 1.6.3.8. If no update is available, temporarily disable the plugin.
Other vulnerabilities in Message Filter for Contact Form 7
See all- CVE-2026-65438High
XSS vulnerability in Message Filter for Contact Form 7 up to version 1.6.3.9. An unauthenticated attacker can inject malicious JavaScript.
- CVE-2025-46252High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter allows Reflected XSS.This issue affects Message Filter for Contact Form 7: from n/a through <= 1.6.3.8.