---
id: "CVE-2026-115498"
kind: "vulnerability"
aliases: ["CVE-2026-115498"]
title: "Slim Jetpack WordPress plugin (removed, unpatched): contact form Website field allows stored XSS"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "slimjetpack", "fixed": [], "affected": "<= 2.7.0.1", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["other", "removed-plugin", "self-hosted", "slim-jetpack", "unpatched", "wordpress", "xss"]
not_affected_if: ["no-contact-form-shortcode", "plugin-newer-than-2.7.0.1", "plugin-not-installed"]
published_at: "2026-11-04T10:17:25+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:29:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115498", "first_seen_at": "2026-11-04T10:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:29:48+00:00"}]
---

# Slim Jetpack WordPress plugin (removed, unpatched): contact form Website field allows stored XSS

The Slim Jetpack WordPress plugin up to version 2.7.0.1 does not sanitize the website field of its contact form. An unauthenticated visitor can submit a script through a page containing the [contact-form] shortcode, and it runs in the browser of anyone who opens that page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:slimjetpack affected <= 2.7.0.1 fixed ?

## How to check

In wp-admin > Plugins, look for Slim Jetpack (slug slimjetpack); 2.7.0.1 or lower is listed as affected and no later version is known. Search posts and pages for the [contact-form] shortcode. Review Feedback entries for submissions whose Website field contains <script or HTML, and check for unknown admin users.

## Fix

No patched version known. Wordfence lists the vulnerability as Unpatched and the plugin as Removed from WordPress.org. Deactivate and delete the plugin, or move to the original Jetpack or another contact-form plugin.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115498
- 2026-11-04T10:29:48+00:00 analyst — Only third-party source found (Wordfence, reporter Yaniv Haliwa, CVSS 7.2, published 2026-11-03). NVD fetch returned nothing; wordpress.org plugin page/API gave nothing. Wordfence says Unpatched and plugin Removed; no vendor statement read, so nothing marked verified and fix-status none rests on Wordfence only. No exploitation or PoC seen.

## Documents

- [advisory] Wordfence: Slim Jetpack <= 2.7.0.1 Unauthenticated Stored XSS via Contact Form Website Field https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slimjetpack/slim-jetpack-2701-unauthenticated-stored-cross-site-scripting-via-contact-form-website-field
- [describes] Wordfence: Slim Jetpack plugin page (status Removed, vulnerability Unpatched) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/slimjetpack

## From the sources

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_