Database for CF7
Database for CF7 is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 29, 2026; the highest published CVSS base score is 7.2.
database-for-cf7CVE-2026-13425: Database for CF7 array submissions permit unauthenticated stored XSS
Database for CF7 through 1.2.6 lets an unauthenticated attacker submit an array where a Contact Form 7 text field is expected, for example your-name[], through /wp-json/contact-form-7/v1/contact-forms/{id}/feedback. On wpcf7_mail_sent, the plugin copies Contact Form 7 posted data and serializes the complete array directly into its wp_cf7db table with $wpdb. When an administrator opens the manage_options-protected Database submenu, wpcf7db_page() unserializes each row and echoes array-valued fields using serialize($field) without HTML escaping. The stored payload can therefore execute in the administrator's browser when the affected submission list is viewed. The plugin does not define a separate submission endpoint; it consumes Contact Form 7's public REST endpoint.
| Safe version |
|
||
|---|---|---|---|
| Jul 29, 2026 |
CVE-2026-13425
Database for CF7 array submissions permit unauthenticated stored XSS
Database for CF7 through 1.2.6 lets an unauthenticated attacker submit an array where a Contact Form 7 text field is expected, for example your-name[], through /wp-json/contact-form-7/v1/contact-forms/{id}/feedback. On wpcf7_mail_sent, the plugin copies Contact Form 7 posted data and serializes the complete array directly into its wp_cf7db table with $wpdb. When an administrator opens the manage_options-protected Database submenu, wpcf7db_page() unserializes each row and echoes array-valued fields using serialize($field) without HTML escaping. The stored payload can therefore execute in the administrator's browser when the affected submission list is viewed. The plugin does not define a separate submission endpoint; it consumes Contact Form 7's public REST endpoint.
|
See mitigation notes |
CVE7.2
NVDPending
|
| Dec 09, 2024 |
CVE-2023-49167
Database for CF7: A security weakness
Database for CF7 is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.5
NVDPending
|