CVE-2026-115498: Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field
The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGEID>-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode.
Event History
Frequently Asked Questions
Which WordPress sites are exposed?
Sites using Slim Jetpack versions through 2.7.0.1 are exposed where a page contains the [contact-form] shortcode. The vulnerable input is the Website contact-form field associated with that page.
Does an attacker need a WordPress account or other privileges?
No. Unauthenticated visitors can submit a payload through the affected contact form because nonce and authentication checks are enforced only for logged-in users.
When does the injected script execute?
The script is stored in the affected page and executes when a user accesses that injected page. This can affect users who view the page after the malicious form submission.