UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-120547

CF7 Apps <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value

Severity
Medium 4.4
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · Only under certain conditions · Needs an administrator account · No user action needed
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Sources
CVE Program

Description

The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability.

From the CVE Program.

Affected software

SoftwareAffected versions
Contact Form 7 Honeypot (WordPress plugin)WordPress plugins · wp-plugin:contact-form-7-honeypot
  • Every version up to 3.8.0

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-120547