CVE-2026-13425: Unauthenticated Stored XSS in Database for CF7 <= 1.2.6

Vulnerability Overview Vulnerability Name: Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values CVSS Score: 7.2 (High) CVE Number: CVE-2026-13425 Publication Date: July 28, 2026 Last Updated: July 29, 2026 Researcher: Chawathon Netsingha (JAN03) Impact Scope Software Type: Plugin Software Name: database-for-cf7 Affected Versions: <= 1.2.6 Patch Status: No known patches Remediation Recommended Action: Review the vulnerability details in depth and implement mitigation measures based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek alternatives. Vulnerability Description Vulnerability Type: Stored Cross-Site Scripting (XSS) Root Cause: Insufficient input sanitization and output escaping allow unauthenticated attackers to inject malicious scripts into pages. Exploitation Method: By submitting array-structured inputs via the public REST API endpoint , the attacker can bypass WordPress's save-time filtering. References plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Database Source: Wordfence Intelligence Vulnerability Database API Access: Free for personal and commercial use Documentation Link: Wordfence Intelligence Documentation Related Recent Vulnerabilities Vulnerability Title: Database for CF7 <= 1.2.4 - Missing Authorization via wpcf7db_delete AJAX action CVE Number: CVE-2023-49167 CVSS Score: 6.5 Researcher: R3N0 Publication Date: November 29, 2023 Contact Information Technical Support: 9am-8pm ET, 6am-5pm PT, 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 paid customer support with a 1-hour response time Legal Statement Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Subject to the licensing terms of Defiant Inc. and MITRE Corporation Social Media Facebook: Wordfence Facebook Twitter: Wordfence Twitter LinkedIn: Wordfence LinkedIn Instagram: Wordfence Instagram Subscribe to Updates Subscription Method: Enter your email address to subscribe to news and updates Other Links Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Privacy Policy Privacy Policy: Privacy Policy and Notice at Collection Data Protection: Do Not Sell or Share My Personal Information Technical Support Technical Support: Wordfence Support Disclaimer Disclaimer: The content of this page is for reference only; specific implementation should be adjusted according to actual circumstances. Summary This vulnerability involves the CF7 plugin in the Wordfence Intelligence database, presenting a risk of unauthenticated stored cross-site scripting attacks. It is recommended to review and take measures to mitigate the risk as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-13425: Unauthenticated Stored XSS in Database for CF7 <= 1.2.6

More from this source