CVE-2026-111574 Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-111574?
CVE-2026-111574 is a high-severity vulnerability in Unknown Redirection for Contact Form 7, published on 21 Oct 2026.
Official description
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.
Weakness: CWE-79
Which versions are affected by CVE-2026-111574?
How do I fix CVE-2026-111574?
No fix has been published for CVE-2026-111574 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111574 being exploited?
There is no known exploitation of CVE-2026-111574 in the wild and no public exploit code.
Sources
Also known as GHSA-fm6v-w7hr-3xm4.