{"id":"CVE-2026-111574","title":"Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox","summary":"The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malici…","severity":"none","cwe":["CWE-79"],"product":"Redirection for Contact Form 7","affected":["redirection_for_contact_form_7 >= 2.2.7 < 3.2.12"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T06:00:22.249Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111574","references":[{"url":"https://wpscan.com/vulnerability/f40440de-3947-48f9-8fa4-200f83e87d8e/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.178Z","slug":"CVE-2026-111574","body":"## Overview\n\nThe Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.\n\n## Affected\n\n- `redirection_for_contact_form_7 >= 2.2.7 < 3.2.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}