Stored Cross-Site Scripting Vulnerability in Database for CF7 Plugin from WordPress

CVE-2026-13425

What is CVE-2026-13425?

The Database for CF7 plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through insecure handling of array-form field values. This flaw arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to insert arbitrary scripts. The vulnerability is particularly concerning because it permits such attacks via the public REST API endpoint, resulting in the execution of malicious scripts in the context of the user’s session whenever the compromised page is accessed. Attackers can exploit the plugin's handling of data submissions with array-structured inputs, which are stored incorrectly in the wp_cf7db table, thus bypassing WordPress's built-in security measures.

References