CVE-2026-101928: Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it by submitting a crafted value in the comment author parameter. No login or user interaction from the attacker is required.

Q: Which versions are affected?

All versions of Magic Tooltips For Contact Form 7 up to and including 1.0.34 are affected.

Q: Where does the injected script execute?

The payload is rendered as executable markup when an administrator views the WordPress comment-management page at wp-admin/edit-comments.php. This can expose administrator sessions or enable actions in the administrator's browser context.

Q: What condition enables the payload to bypass normal filtering?

The plugin's esc_html filter callback decodes HTML-entity-encoded input back into live HTML. A payload encoded with entities such as <tip> can therefore bypass sanitize_text_field when supplied as a comment author name.

Published Oct 3, 2026

Updated

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin's eschtml filter callback decodes HTML-entity-encoded payloads (e.g. those containing '<tip>') back into live HTML, meaning an entity-encoded script payload submitted as a comment author name — which bypasses sanitizetextfield — is rendered as executable markup when an administrator views wp-admin/edit-comments.php.

Affected Software

1 affected component

WordPress Magic Tooltips For Contact Form 7<=1.0.34

Event History

Oct 3, 2026

CVE Published

via MITRE·05:29 AM

Data Sourced

via MITRE·05:29 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it by submitting a crafted value in the comment author parameter. No login or user interaction from the attacker is required.

Which versions are affected?

All versions of Magic Tooltips For Contact Form 7 up to and including 1.0.34 are affected.

Where does the injected script execute?

The payload is rendered as executable markup when an administrator views the WordPress comment-management page at wp-admin/edit-comments.php. This can expose administrator sessions or enable actions in the administrator's browser context.

What condition enables the payload to bypass normal filtering?

The plugin's esc_html filter callback decodes HTML-entity-encoded input back into live HTML. A payload encoded with entities such as <tip> can therefore bypass sanitize_text_field when supplied as a comment author name.

CVE-2026-101928: Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

Where does the injected script execute?

What condition enables the payload to bypass normal filtering?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions are affected?

Where does the injected script execute?

What condition enables the payload to bypass normal filtering?