{"id":"CVE-2026-13425","state":"PUBLISHED","title":"Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values","description":"The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because Contact Form 7 accepts array-structured input for ordinary text fields (e.g., your-name[]) via the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom wp_cf7db table, bypassing WordPress save-time filtering via wp_insert_post/wp_kses.","publishedAt":"2026-07-29T07:48:01.501Z","updatedAt":"2026-07-29T13:20:52.312Z","severity":{"score":7.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","source":"Wordfence"},"assigner":"Wordfence","products":["code4life Database for CF7"],"affected":[{"vendor":"code4life","product":"Database for CF7","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.2.6","versionType":"semver"}]}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/07fda92e-a085-42c7-a16d-1eace1dee195?source=cve","https://plugins.trac.wordpress.org/browser/database-for-cf7/trunk/database-for-cf7.php#L236","https://plugins.trac.wordpress.org/browser/database-for-cf7/trunk/database-for-cf7.php#L118"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/13xxx/CVE-2026-13425.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13425","state":"PUBLISHED","datePublished":"2026-07-29T07:48:01.501Z","dateUpdated":"2026-07-29T13:20:52.312Z","assignerShortName":"Wordfence","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateReserved":"2026-06-26T13:05:29.224Z"},"containers":{"cna":{"title":"Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values","descriptions":[{"lang":"en","value":"The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because Contact Form 7 accepts array-structured input for ordinary text fields (e.g., your-name[]) via the public REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom wp_cf7db table, bypassing WordPress save-time filtering via wp_insert_post/wp_kses."}],"affected":[{"vendor":"code4life","product":"Database for CF7","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.2.6","versionType":"semver"}]}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/07fda92e-a085-42c7-a16d-1eace1dee195?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/database-for-cf7/trunk/database-for-cf7.php#L236"},{"url":"https://plugins.trac.wordpress.org/browser/database-for-cf7/trunk/database-for-cf7.php#L118"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"Wordfence","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateUpdated":"2026-07-29T07:48:01.501Z"},"credits":[{"lang":"en","type":"finder","value":"Chawabhon Netisingha (JNX03)"}],"timeline":[{"time":"2026-07-28T19:00:57.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-29T13:07:31.978043Z","id":"CVE-2026-13425","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-29T13:20:52.312Z"}}]}}}