Stored Cross-Site Scripting Vulnerability in Business Essentials for Contact Form 7 by WordPress

CVE-2026-97661

What is CVE-2026-97661?

The Business Essentials for Contact Form 7 plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability owing to inadequate input sanitization and output escaping. This flaw allows unauthenticated attackers to inject malicious scripts through the 'gateway' Form Field in all versions up to and including 1.2.1. Once exploited, the harmful scripts can execute whenever users access pages with the compromised forms. For the exploitation to be successful, the Payments module must be activated and configured to accept both PayPal and Stripe payment gateways.

References