CVE-2026-39731: WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The issue is unauthenticated, so the attacker does not need a WordPress account or other prior privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.

Q: Which installations are affected?

WordPress sites using Database for CF7 version 1.2.6 or earlier are affected according to the available information.

Q: What are the potential consequences of successful exploitation?

Successful XSS can affect confidentiality, integrity, and availability at low impact. The CVSS vector also indicates that the impact can extend beyond the vulnerable component's security authority.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

Affected Software

1 affected component

WordPress Database for CF7<=1.2.6

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is unauthenticated, so the attacker does not need a WordPress account or other prior privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.

Which installations are affected?

WordPress sites using Database for CF7 version 1.2.6 or earlier are affected according to the available information.

What are the potential consequences of successful exploitation?