Cross-site Scripting Vulnerability in Contact Form 7 - Post Fields Plugin by Markus Wiesenhofer
CVE-2026-121768

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Contact Form 7 – Post Fields
Vendor
CVE Published:
7 November 2026

What is CVE-2026-121768?

A vulnerability in the Contact Form 7 - Post Fields plugin enables an attacker to exploit improper neutralization of user input, leading to Stored XSS. This issue allows for malicious scripts to be injected and executed in a user's browser when the web page is generated. It affects all versions up to 2.6.0, making it critical for users to update their plugins to prevent potential security breaches.

Affected Version(s)

Contact Form 7 &#8211; Post Fields 0 <= 2.6.0

References

https://patchstack.com/database/wordpress/plugin/cf7-post...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

cazy | Patchstack Bug Bounty Program
.