CVE-2026-40807: WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

The affected product is the WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin. Versions 3.2.6 and earlier are affected.

No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or existing plugin privileges.

The vector includes user interaction, as indicated by the UI:R metric. A user must interact with attacker-controlled content for the XSS to execute.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

Affected Software

1 affected component

WordPress CF7 Views – Complete Entry Management for Contact Form 7<=3.2.6

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced