{"id":"CVE-2026-115498","kind":"vulnerability","aliases":["CVE-2026-115498"],"related":[],"title":"Slim Jetpack WordPress plugin (removed, unpatched): contact form Website field allows stored XSS","description":"The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode.","summary":"The Slim Jetpack WordPress plugin up to version 2.7.0.1 does not sanitize the website field of its contact form. An unauthenticated visitor can submit a script through a page containing the [contact-form] shortcode, and it runs in the browser of anyone who opens that page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"slimjetpack","fixed":[],"affected":"<= 2.7.0.1","ecosystem":"wordpress"}],"ecosystems":[],"tags":["other","removed-plugin","self-hosted","slim-jetpack","unpatched","wordpress","xss"],"not_affected_if":["no-contact-form-shortcode","plugin-newer-than-2.7.0.1","plugin-not-installed"],"how_to_check":"In wp-admin > Plugins, look for Slim Jetpack (slug slimjetpack); 2.7.0.1 or lower is listed as affected and no later version is known. Search posts and pages for the [contact-form] shortcode. Review Feedback entries for submissions whose Website field contains <script or HTML, and check for unknown admin users.","fix":"No patched version known. Wordfence lists the vulnerability as Unpatched and the plugin as Removed from WordPress.org. Deactivate and delete the plugin, or move to the original Jetpack or another contact-form plugin.","status":"open","published_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:14+00:00","updated_at":"2026-11-04T10:29:48+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-04T10:27:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Slim Jetpack WordPress plugin: contact form lets visitors store scripts","impact":"medium","summary":"The Slim Jetpack WordPress plugin up to version 2.7.0.1 does not sanitize the website field of its contact form. An unauthenticated visitor can submit a script through a page containing the [contact-form] shortcode, and it runs in the browser of anyone who opens that page.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","slim-jetpack","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' browsers on the site","analyst_note":"Confirm whether a patched Slim Jetpack version exists beyond 2.7.0.1 by checking the plugin's WordPress.org changelog or the NVD entry.","how_to_check":"- Check whether the Slim Jetpack plugin is installed and its version is `2.7.0.1` or lower, in the WordPress Plugins screen or the plugin's main file header.\n- Look for pages that contain the `[contact-form]` shortcode.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-contact-form-shortcode","plugin-newer-than-2.7.0.1"],"who_is_affected":"Sites running the Slim Jetpack plugin at version 2.7.0.1 or earlier that have a page with the [contact-form] shortcode. The flaw lies in the contact form's unauthenticated submission path, so sites without that form on a public page are less exposed. The sources do not state a fixed version.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4250,"output_tokens":620,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a patched Slim Jetpack version exists beyond 2.7.0.1 by checking the plugin's WordPress.org changelog or the NVD entry.","search":"'-115498':16A,19A '-2026':15A,18A '2.7.0.1':42B,111C 'access':140C 'allow':11A,160C 'anyon':76B 'arbitrari':129C 'attack':126C 'authent':147C 'browser':74B 'check':148C 'contact':7A,51B,66B,101C,172C 'contact-field':100C 'contact-form':65B,171C 'contain':63B,169C 'cross':92C 'cross-sit':91C 'cve':14A,17A 'due':112C 'enforc':154C 'escap':119C 'execut':136C 'field':10A,48B,102C 'form':8A,52B,67B,150C,173C 'g':97C 'host':27B 'includ':110C 'inject':128C,142C 'input':115C 'insuffici':114C 'jetpack':2A,30B,36B,83C 'log':157C 'logged-in':156C 'make':121C 'nonc':145C 'open':78B 'output':118C 'page':62B,80B,133C,143C,168C 'paramet':103C 'payload':165C 'plugin':4A,24B,38B,84C 'possibl':123C 'remov':5A,23B 'removed-plugin':22B 'run':71B 'sanit':45B,116C 'script':59B,94C,131C 'self':26B 'self-host':25B 'shortcod':68B,174C 'site':93C 'slim':1A,29B,35B,82C 'slim-jetpack':28B 'slimjetpack':20A 'store':12A,90C,164C 'submiss':151C 'submit':57B 'unauthent':54B,125C,161C 'unpatch':6A,31B 'user':139C,159C 'version':41B,106C 'via':95C,166C 'visitor':55B,162C 'vulner':88C 'web':130C 'websit':9A,47B,98C,99C 'whenev':137C 'wordpress':3A,32B,37B,86C 'xss':13A,33B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Slim Jetpack plugin (up to 2.7.0.1, the only range Wordfence lists) with a public page that uses the [contact-form] shortcode. Any visitor can store a script through the Website field, and it runs in the browser of whoever views the injected page or submission, such as an admin. Sites without the plugin or without a contact-form shortcode can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["slimjetpack"],"ptokens":["slimjetpack"],"labels":["high","other","removedplugin","selfhosted","slimjetpack","unpatched","wordpress","xss"],"campaign_type":null,"first_public_at":"2026-11-04T10:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115498","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115498","severity":null,"published_at":"2026-11-04T10:17:25+00:00","modified_at":"2026-11-04T10:17:25+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115498:1658","url":null,"severity":null,"published_at":"2026-11-04T10:29:48+00:00","modified_at":"2026-11-04T10:29:48+00:00","first_seen_at":"2026-11-04T10:29:48+00:00","fetched_at":"2026-11-04T10:29:48+00:00","note":"Only third-party source found (Wordfence, reporter Yaniv Haliwa, CVSS 7.2, published 2026-11-03). NVD fetch returned nothing; wordpress.org plugin page/API gave nothing. Wordfence says Unpatched and plugin Removed; no vendor statement read, so nothing marked verified and fix-status none rests on Wordfence only. No exploitation or PoC seen."}],"documents":[{"id":66164,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slimjetpack/slim-jetpack-2701-unauthenticated-stored-cross-site-scripting-via-contact-form-website-field","title":"Wordfence: Slim Jetpack <= 2.7.0.1 Unauthenticated Stored XSS via Contact Form Website Field","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":66165,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slimjetpack","title":"Wordfence: Slim Jetpack plugin page (status Removed, vulnerability Unpatched)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}