{"id":"CVE-2026-120547","kind":"vulnerability","aliases":["CVE-2026-120547"],"related":[],"title":"CF7 Apps WordPress plugin: stored cross-site scripting via honeypot tag","description":"The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability.","summary":"The CF7 Apps plugin for WordPress does not sanitize the honeypot tag value in Contact Form 7 form bodies, up to and including version 3.8.0. An authenticated user with custom-level access or above can store scripts that run in the browser of anyone who opens the injected page.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cf7-apps","contact-form-7","package","wordpress"],"not_affected_if":["no-untrusted-editors","plugin-not-installed"],"how_to_check":"- Check whether the CF7 Apps plugin (Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7) is installed and its version is `3.8.0` or earlier in the WordPress plugins screen.\n- Check whether multisite is enabled or `DISALLOW_UNFILTERED_HTML` is set to true in `wp-config.php`.","fix":null,"status":"open","published_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","triaged_at":"2026-11-13T10:58:52+00:00","updated_at":"2026-11-13T10:58:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:58:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"CF7 Apps WordPress plugin: stored cross-site scripting via honeypot tag","impact":"medium","summary":"The CF7 Apps plugin for WordPress does not sanitize the honeypot tag value in Contact Form 7 form bodies, up to and including version 3.8.0. An authenticated user with custom-level access or above can store scripts that run in the browser of anyone who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","contact-form-7","cf7-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers on injected pages","analyst_note":"Confirm the fixed version from the NVD or plugin vendor page; the sources state no fix.","how_to_check":"- Check whether the CF7 Apps plugin (Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7) is installed and its version is `3.8.0` or earlier in the WordPress plugins screen.\n- Check whether multisite is enabled or `DISALLOW_UNFILTERED_HTML` is set to true in `wp-config.php`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-untrusted-editors"],"who_is_affected":"Sites running the CF7 Apps plugin at version 3.8.0 or earlier that let custom-level or higher users edit Contact Form 7 forms. The sources say the escalation matters most on multisite installs or sites with DISALLOW_UNFILTERED_HTML enabled, since Editors on default single-site installs already hold the unfiltered_html capability. Sites without the plugin, or without untrusted authenticated editors, are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000811,"input_tokens":4735,"output_tokens":674,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120547':15A,18A '-2026':14A,17A '3.8.0':52B,122C '7':25B,44B,90C 'access':60B,142C,158C 'addon':86C 'alreadi':190C 'anyon':72B 'app':2A,21B,30B,80C 'arbitrari':147C 'attack':137C 'authent':54B,136C 'bodi':46B,109C 'browser':70B 'capabl':195C 'cf7':1A,20B,29B,79C,107C 'cf7-apps':19B 'contact':23B,42B,88C 'contact-form':22B 'cross':7A,99C 'cross-sit':6A,98C 'custom':58B,140C 'custom-level':57B,139C 'cve':13A,16A 'databas':82C 'default':185C 'disallow':175C 'due':123C 'editor':181C 'editor-level':180C 'enabl':178C 'escal':168C 'escap':130C 'execut':154C 'form':24B,43B,45B,89C,106C,108C 'honeypot':11A,38B,81C,111C 'html':177C,194C 'includ':50B,121C 'inject':76B,146C,160C 'input':126C 'instal':171C,189C 'insuffici':125C 'level':59B,141C,182C 'make':132C 'meaning':166C 'multisit':170C 'open':74B 'output':129C 'packag':26B 'page':77B,151C,161C 'paramet':114C 'plugin':4A,31B,91C 'possess':191C 'possibl':134C 'privileg':167C 'redirect':83C 'run':67B 'sanit':36B,127C 'script':9A,65B,101C,149C 'singl':187C 'single-sit':186C 'site':8A,100C,188C 'store':5A,64B,97C 'tag':12A,39B,112C 'unfilt':176C,193C 'user':55B,157C,183C 'valu':40B,113C 'version':51B,117C 'via':10A,102C 'vulner':95C 'web':148C 'webhook':84C 'whenev':155C 'wordpress':3A,27B,33B,93C 'wpcf7':105C 'wpcf7-form':104C","nicknames":[],"mitigations":[],"who_affected":"Sites running the CF7 Apps plugin at version 3.8.0 or earlier that let custom-level or higher users edit Contact Form 7 forms. The sources say the escalation matters most on multisite installs or sites with DISALLOW_UNFILTERED_HTML enabled, since Editors on default single-site installs already hold the unfiltered_html capability. Sites without the plugin, or without untrusted authenticated editors, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cf7apps","contactform7","medium","package","wordpress"],"campaign_type":null,"search_a":"'-120547':15A,18A '-2026':14A,17A 'app':2A 'cf7':1A 'cross':7A 'cross-sit':6A 'cve':13A,16A 'honeypot':11A 'plugin':4A 'script':9A 'site':8A 'store':5A 'tag':12A 'via':10A 'wordpress':3A","search_b":"'3.8.0':52B '7':25B,44B 'access':60B 'anyon':72B 'app':21B,30B 'authent':54B 'bodi':46B 'browser':70B 'cf7':20B,29B 'cf7-apps':19B 'contact':23B,42B 'contact-form':22B 'custom':58B 'custom-level':57B 'form':24B,43B,45B 'honeypot':38B 'includ':50B 'inject':76B 'level':59B 'open':74B 'packag':26B 'page':77B 'plugin':31B 'run':67B 'sanit':36B 'script':65B 'store':64B 'tag':39B 'user':55B 'valu':40B 'version':51B 'wordpress':27B,33B","search_c":"'3.8.0':122C '7':90C 'access':142C,158C 'addon':86C 'alreadi':190C 'app':80C 'arbitrari':147C 'attack':137C 'authent':136C 'bodi':109C 'capabl':195C 'cf7':79C,107C 'contact':88C 'cross':99C 'cross-sit':98C 'custom':140C 'custom-level':139C 'databas':82C 'default':185C 'disallow':175C 'due':123C 'editor':181C 'editor-level':180C 'enabl':178C 'escal':168C 'escap':130C 'execut':154C 'form':89C,106C,108C 'honeypot':81C,111C 'html':177C,194C 'includ':121C 'inject':146C,160C 'input':126C 'instal':171C,189C 'insuffici':125C 'level':141C,182C 'make':132C 'meaning':166C 'multisit':170C 'output':129C 'page':151C,161C 'paramet':114C 'plugin':91C 'possess':191C 'possibl':134C 'privileg':167C 'redirect':83C 'sanit':127C 'script':101C,149C 'singl':187C 'single-sit':186C 'site':100C,188C 'store':97C 'tag':112C 'unfilt':176C,193C 'user':157C,183C 'valu':113C 'version':117C 'via':102C 'vulner':95C 'web':148C 'webhook':84C 'whenev':155C 'wordpress':93C 'wpcf7':105C 'wpcf7-form':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120547","severity":null,"published_at":"2026-11-13T10:17:26+00:00","modified_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","fetched_at":"2026-11-13T10:47:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}