Cross-Site Scripting Vulnerability in Divi Contact Form 7 by Fahim Reza
CVE-2026-62057

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Divi Contact Form 7
Vendor
CVE Published:
30 October 2026

What is CVE-2026-62057?

A Cross-Site Scripting (XSS) vulnerability allows for the injection of malicious scripts into web pages accessed by users. This vulnerability in the Divi Contact Form 7 plugin developed by Fahim Reza can lead to unauthorized actions or data theft when attackers leverage improper neutralization of script-related HTML tags. It affects versions of the plugin up to 4.1.0, making it essential for users to apply necessary updates promptly to safeguard their applications against potential exploitation.

Affected Version(s)

Divi Contact Form 7 0 <= 4.1.0

References

https://patchstack.com/database/wordpress/plugin/cf7-styl...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

neurotx | Patchstack Bug Bounty Program
.