CVE-2026-40807: WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability
Published Oct 6, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
Affected Software
1 affected component
WordPress CF7 Views – Complete Entry Management for Contact Form 7<=3.2.6
Event History
Oct 6, 2026
CVE Published
via MITRE·08:34 AM
Data Sourced
via MITRE·08:34 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
The affected product is the WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin. Versions 3.2.6 and earlier are affected.
2
Does exploitation require an authenticated WordPress account?
No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or existing plugin privileges.
3
What must happen for the XSS payload to execute?
The vector includes user interaction, as indicated by the UI:R metric. A user must interact with attacker-controlled content for the XSS to execute.