CVE-2026-65438
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
XSS vulnerability in Message Filter for Contact Form 7 up to version 1.6.3.9. An unauthenticated attacker can inject malicious JavaScript.
Risk Assessment
Risk includes session theft, redirection to malicious sites, or theft of sensitive data.
Recommendation
Update the Message Filter for Contact Form 7 plugin to the latest version.
Other vulnerabilities in Message Filter for Contact Form 7
See all- CVE-2026-57423High
The Message Filter for Contact Form 7 WordPress plugin is vulnerable to Reflected Cross-site Scripting (XSS) in versions up to and including 1.6.3.8. An attacker can inject malicious scripts due to improper input neutralization during page generation.
- CVE-2025-46252High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.