Stored Cross-Site Scripting Vulnerability in Contact Form DB Plugin for WordPress

CVE-2026-83592

What is CVE-2026-83592?

The Contact Form DB for Enfold plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping mechanisms. This vulnerability allows unauthenticated attackers to inject arbitrary JavaScript or other web scripts into contact form field values, which may execute when an unsuspecting user accesses an affected page. The vulnerability is present in all versions up to and including 2.0.2, where the malicious content is rendered unescaped within HTML attributes and table cells in the admin interface, bypassing typical security measures like base64 encoding and serialization.

References