Live › vulnerability › CVE-2026-112379
Go to dashboardThe Contact Form Email plugin by Codepeople, versions through 1.3.68, does not neutralize input before rendering it in a page, which makes it a stored cross-site scripting flaw. An attacker who can get script into a form field can run JavaScript in the browser of anyone who later views the stored data, such as an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Contact Form Email plugin at version 1.3.68 or earlier are exposed, where form submissions are displayed back to staff in a browser. Sites that do not have this plugin installed can skip it.
No product ranges from the sources yet.
contact-form-to-email plugin is installed and its version in the WordPress admin plugins list or wp plugin list1.3.68, or remove the plugin if it is not neededEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
This page as .md · .json · in your agent: get_signal("CVE-2026-112379")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.