CVE-2025-47626: WordPress Submission DOM tracking for Contact Form 7 plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in apasionados Submission DOM tracking for Contact Form 7 cf7-submission-dom-tracking allows Stored XSS.This issue affects Submission DOM tracking for Contact Form 7: from n/a through <= 2.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47626?
CVE-2025-47626 is classified as a high-severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2025-47626?
To fix CVE-2025-47626, update the Submission DOM tracking for Contact Form 7 plugin to a version later than 2.0.
What does CVE-2025-47626 allow an attacker to do?
CVE-2025-47626 allows an attacker to inject malicious scripts into web pages through stored XSS, compromising user data.
Which software is affected by CVE-2025-47626?
CVE-2025-47626 affects the Submission DOM tracking for Contact Form 7 version 2.0 and earlier.
Are there any known exploits for CVE-2025-47626?
While specific exploits may not be publicly documented, the nature of stored XSS means that attack vectors could be developed based on the vulnerability.