CVE-2026-23970: Unauthenticated XSS in Contact Form 7 ≤3.2.8 – Patch Now

Technical summary

CVE-2026-23970 is an unauthenticated reflected XSS vulnerability (CWE-79) in Contact Form 7's redirection handler. The vulnerability exists in form versions 3.2.8 and below. The attack vector is network-based, complexity is low, and the exploit requires user interaction—specifically, a victim must visit a crafted link or submit a form with attacker-controlled redirect parameters. The resulting script execution occurs in the victim's browser context with the same privileges as the user, enabling credential theft, session hijacking, or phishing payloads. The CVSS 3.1 score of 7.1 (HIGH) reflects a wide attack surface (unauthenticated), moderate impact (CIA all affected at low level), and cross-site request scope.

Business impact

Organizations running Contact Form 7 risk compromise of visitor and customer data entered through contact forms. XSS payloads can harvest email addresses, names, phone numbers, or other personal information submitted mid-form. Additionally, attackers can redirect users to phishing sites or malicious domains, damaging trust and brand reputation. Website administrators should prioritize patching to prevent data exfiltration and maintain compliance with privacy frameworks (GDPR, CCPA).

Affected systems

Contact Form 7 version 3.2.8 and all earlier versions are affected. The plugin is widely deployed on WordPress sites for contact form functionality. Organizations using version 3.2.9 or later are not affected. Verify your installed version in WordPress admin settings or through the plugin metadata.

Exploitability

This vulnerability has moderate exploitability. While it requires victim interaction—the victim must click a malicious link or the attacker must inject a payload into a form submission—the attack is unauthenticated and does not require special conditions. An attacker could craft a URL with a malicious redirect parameter and distribute it via email, social engineering, or compromised search results. No exploit code or proof-of-concept is required; standard JavaScript injection techniques apply. The CVSS vector reflects that remediation is not applied automatically, giving the vulnerability sufficient headroom for widespread abuse if left unpatched.

Remediation

Upgrade Contact Form 7 to version 3.2.9 or later. This patch corrects the unsafe redirection handling and sanitizes user-supplied redirect parameters. After updating, test contact form submissions and confirm that legitimate redirects still function. No database migration or configuration changes are required. Organizations unable to upgrade immediately should restrict access to contact forms or implement Web Application Firewall (WAF) rules to block requests containing suspicious redirect parameters.

Patch guidance

WordPress administrators should apply the security update to Contact Form 7 as soon as possible. The patch is available through the WordPress plugin directory. Navigate to Plugins > Installed Plugins, select Contact Form 7, and click Update if version 3.2.9 or later is available. Alternatively, download the patched version directly from the official Contact Form 7 WordPress repository and upload it manually if automatic updates are disabled. Verify the update completion by confirming the plugin version in the plugin list.

Detection guidance

Monitor web server and WAF logs for requests containing suspicious redirect parameters in Contact Form 7 submissions (e.g., URLs with 'redirect', 'url', or similar parameters containing JavaScript, data: URIs, or protocol handlers like 'javascript:'). Check for 400/403 responses if WAF rules block such requests. Use SIEM tools to correlate form submission logs with subsequent outbound requests to external domains, which may indicate successful exploitation. For WordPress sites, enable security logging plugins that track plugin version and update status to ensure timely patching. Scan user-submitted form data for encoded or obfuscated script tags.

Why prioritize this

This vulnerability merits high priority due to its combination of unauthenticated access, low attack complexity, and cross-site scope. Contact Form 7 is a ubiquitous WordPress plugin, making the affected user base large. The ability to execute arbitrary JavaScript in visitor browsers without authentication makes it attractive for opportunistic attackers. The HIGH CVSS score reflects legitimate confidentiality, integrity, and availability impact. Organizations should prioritize patching before attackers develop and distribute automated exploitation frameworks.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is driven by several factors: (1) Network-based attack vector with no authentication required, (2) Low attack complexity—standard XSS injection, (3) Required user interaction—the victim must click a link or submit a form, (4) Changed scope—the vulnerability can affect confidentiality, integrity, and availability across the web application and user context, and (5) Low-to-moderate impact on all three security properties. The score reflects a threat that is achievable by moderately skilled attackers but not trivially exploitable without some social engineering or distribution effort.

Frequently asked questions