Live › vulnerability › CVE-2026-111574
Go to dashboardThe Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not escape submitted form data when it shows lead entries in the debug metabox. An unauthenticated attacker can store a script that runs in the browser of a logged-in user who views that entry while debug mode is enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Redirection for Contact Form 7 plugin before 3.2.12 with debug mode enabled. The attack needs a logged-in administrator or editor to open the lead entry in the debug metabox, so sites with debug mode off are not exposed by this flaw.
No product ranges from the sources yet.
wp plugin get redirection-for-contact-form-7 --field=version3.2.12 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
This page as .md · .json · in your agent: get_signal("CVE-2026-111574")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.