---
id: "CVE-2026-120547"
page: "https://infrastack.ai/live/CVE-2026-120547"
kind: "vulnerability"
aliases: ["CVE-2026-120547"]
title: "CF7 Apps WordPress plugin: stored cross-site scripting via honeypot tag"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cf7-apps", "contact-form-7", "package", "wordpress"]
not_affected_if: ["no-untrusted-editors", "plugin-not-installed"]
published_at: "2026-11-13T10:17:26+00:00"
first_seen_at: "2026-11-13T10:47:10+00:00"
updated_at: "2026-11-13T10:58:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120547", "first_seen_at": "2026-11-13T10:47:10+00:00"}]
exploit_sources: []
---

# CF7 Apps WordPress plugin: stored cross-site scripting via honeypot tag

Link for people: https://infrastack.ai/live/CVE-2026-120547 (this .md is for agents)

The CF7 Apps plugin for WordPress does not sanitize the honeypot tag value in Contact Form 7 form bodies, up to and including version 3.8.0. An authenticated user with custom-level access or above can store scripts that run in the browser of anyone who opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the CF7 Apps plugin (Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7) is installed and its version is `3.8.0` or earlier in the WordPress plugins screen.
- Check whether multisite is enabled or `DISALLOW_UNFILTERED_HTML` is set to true in `wp-config.php`.

## Timeline

- 2026-11-13T10:47:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120547

## From the sources

The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_