CVE-2026-112379: WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Contact Form Email pluginto a version that resolves this vulnerability.Fixed in 1.3.69
Event History
Frequently Asked Questions
Which installations should be treated as affected?
Codepeople Contact Form Email installations running version 1.3.68 or earlier should be treated as affected. The affected-version range has no stated lower bound.
What does an attacker need to exploit this issue?
The vector indicates network access, low attack complexity, and no required privileges. User interaction is required for exploitation.
What is the potential security impact?
The issue is a stored XSS vulnerability with low confidentiality, integrity, and availability impacts in the supplied vector. The vector also indicates that the impact can extend beyond the initially affected security authority.