Stored Cross-Site Scripting in Contact Form 7 Database Addon for WordPress
CVE-2025-6740
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 July 2025
What is CVE-2025-6740?
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) through the 'tmpD' parameter. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into web pages. Consequently, whenever a user accesses a compromised page, the injected scripts can execute, potentially compromising user data and site integrity.
Affected Version(s)
Contact Form 7 Database Addon – CFDB7 * <= 1.3.1