CVE-2026-23970— WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Themeisle | Redirection for Contact Form 7 | n/a≤ 3.2.8 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-23970
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Themeisle Redirection for Contact Form 7 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Redirection for Contact Form 7是Themeisle公司的一款Redirection插件的CMS扩展组件。 Themeisle Redirection for Contact Form 7 3.2.8及之前版本存在跨站脚本漏洞，该漏洞源于容易受到跨站脚本攻击，可能导致未经验证的用户执行恶意脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Themeisle | Redirection for Contact Form 7 | n/a ~ 3.2.8 | - |
II. Public POCs for CVE-2026-23970
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23970
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-23970 (1)
Same Patch Batch · Themeisle · 2026-06-15 · 3 CVEs total
| CVE-2026-39507 | 7.1 HIGH | WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-42378 | 6.5 MEDIUM | WordPress WP Full Stripe Free plugin <= 8.4.1 - Broken Authentication vulnerability |
IV. Related Vulnerabilities
Same product: Redirection for Contact Form 7
- CVE-2025-14800
Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Ar - CVE-2025-9562
Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Con - CVE-2025-8141
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Ar - CVE-2025-8145
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PH - CVE-2025-8289
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PH
Same vendor: Themeisle
- CVE-2026-66437
WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forge - CVE-2026-65563
WordPress Orbit Fox by ThemeIsle plugin <= 3.0.7 - Cross Sit - CVE-2026-15653
Visualizer <= 4.0.5 - Authenticated (Contributor+) Stored Cr - CVE-2026-65537
WordPress Cyr to Lat reloaded – transliteration of links and - CVE-2026-65526
WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnera
Same weakness: CWE-79
- CVE-2026-66711
WordPress WooCommerce Multilingual & Multicurrency plugin <= - CVE-2026-66707
WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross S - CVE-2026-66706
WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site - CVE-2026-66705
WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Sit - CVE-2026-66703
WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scriptin
V. Comments for CVE-2026-23970
No comments yet