Stored Cross-Site Scripting Vulnerability in Contact Form 7 Plugin for WordPress

CVE-2025-9562

What is CVE-2025-9562?

The Contact Form 7 plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access to inject arbitrary web scripts through the plugin's qs_date shortcode. This is due to insufficient input sanitization and output escaping on user-supplied attributes. When a user accesses a page containing the injected scripts, the attacker's code executes, potentially compromising user data and site security.

References