CVE-2026-111574: Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Redirection for Contact Form 7to a version that resolves this vulnerability.Fixed in 3.2.12
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using Redirection for Contact Form 7 before version 3.2.12 are exposed if debug mode is enabled and a logged-in user views a lead entry. An attacker does not need to authenticate to submit the malicious form data.
What must happen for the stored script to execute?
The attacker must submit malicious data through a form that is stored as a lead entry. The script executes when a logged-in user opens that entry in the lead debug metabox while debug mode is enabled.
Is debug mode relevant to exploitability?
Yes. The vulnerable output is the lead debug metabox, and the described execution condition requires the plugin's debug mode to be enabled.
What version fixes the issue?
Update Redirection for Contact Form 7 to version 3.2.12 or later. Versions before 3.2.12 are affected.