CVE-2026-111574— Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
Quick assessment
Affected
Unknown Redirection for Contact Form 7
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 3.2.12 版本之前的"Redirection for Contact Form 7"WordPress 插件中，未对作为潜在客户（lead）条目存储的表单提交数据进行清理或转义，随后在潜在客户调试元框（lead debug metabox）中输出这些数据。这允许未认证的攻击者存储恶意脚本；当已登录用户启用该插件（3.2.12 版本之前）的调试模式并查看该条目时，恶意脚本将被执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Redirection for Contact Form 7 | 2.2.7< 3.2.12 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111574
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
Source: CVE Program / CVE List V5
Vulnerability Description
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Redirection for Contact Form 7 | 2.2.7 ~ 3.2.12 | - |
|
II. Public POCs for CVE-2026-111574
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111574
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-21 · 53 CVEs total
| CVE-2026-85683 | 8.8 HIGH | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL |
| CVE-2026-14556 | 5.4 MEDIUM | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie |
| CVE-2026-107447 | 5.3 MEDIUM | Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP |
| CVE-2026-105256 | 5.3 MEDIUM | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
| CVE-2026-104641 | 5.3 MEDIUM | Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Re |
| CVE-2026-103301 | 5.3 MEDIUM | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp |
| CVE-2026-101138 | 5.3 MEDIUM | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass |
| CVE-2026-104642 | 2.7 LOW | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio |
| CVE-2026-105257 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR | |
| CVE-2026-110514 | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR | |
| CVE-2026-107127 | Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF | |
| CVE-2026-107128 | Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth | |
| CVE-2026-107788 | SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion | |
| CVE-2026-107790 | WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title | |
| CVE-2026-107789 | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR | |
| CVE-2026-108073 | SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter | |
| CVE-2026-109147 | WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter | |
| CVE-2026-109926 | Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation | |
| CVE-2026-110523 | WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati | |
| CVE-2026-100145 | Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Redirection for Contact Form 7
-
CVE-2026-80439
Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthentica -
CVE-2026-23970
WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - C -
CVE-2025-14800
Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Ar -
CVE-2025-9562
Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Con -
CVE-2025-8141
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Ar
Same vendor: Unknown
-
CVE-2026-114429
WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot C -
CVE-2026-113674
GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Lis -
CVE-2026-113673
GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export -
CVE-2026-113493
GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map -
CVE-2026-112207
Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Do
V. Comments for CVE-2026-111574
No comments yet