{"id":"CVE-2026-111574","title":"Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox","summary":"The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malici…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"adp","cwe":["CWE-79"],"product":"Redirection for Contact Form 7","affected":["redirection_for_contact_form_7 >= 2.2.7 < 3.2.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-21T10:18:42.013010Z"},"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T10:35:03.878Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111574","references":[{"url":"https://wpscan.com/vulnerability/f40440de-3947-48f9-8fa4-200f83e87d8e/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.178Z","epss":0.00308,"epssPercentile":0.23423,"slug":"CVE-2026-111574","body":"## Overview\n\nThe Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.\n\n## Affected\n\n- `redirection_for_contact_form_7 >= 2.2.7 < 3.2.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":226926,"id":"CVE-2026-111574","ts":1792579637415,"field":"cvss","old":null,"new":"7.5"},{"seq":226925,"id":"CVE-2026-111574","ts":1792579637415,"field":"severity","old":"none","new":"high"}]}