CVE-2026-111574
Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
| Vendor | unknown |
| Product | redirection for contact form 7 |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown redirection for contact form 7
Be the first to know when new unknown vulnerabilities affecting unknown redirection for contact form 7 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Redirection for Contact Form 7
2.2.7 < 3.2.12
References
Credits
Dmitrii Ignatyev WPScan