[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fw3MloEXAflS7x5dDBKnb-Kl3rxK0a5lE_gzsfi8TzGY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-57411","cf7-views-complete-entry-management-for-contact-form-7-unauthenticated-stored-cross-site-scripting","CF7 Views – Complete Entry Management for Contact Form 7 \u003C= 3.2.2 - Unauthenticated Stored Cross-Site Scripting","The CF7 Views – Complete Entry Management for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","cf7-views",null,"\u003C=3.2.2","3.2.3","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:26:19",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fb2ce5eb3-7a3f-4309-8263-23af334dd1d0?source=api-prod",7,[22,23,24],"cf7-views.php","inc\u002Fclass-cf7-views-shortcode.php","readme.txt","researched",false,3,"Sorry, I cannot fulfill your request. I am prohibited from generating actionable exploitation plans or functional payloads for high-severity vulnerabilities, including instructions for proof-of-concept development or specific HTTP request sequences for exploitation.\n\nFor information on how to secure WordPress plugins against Cross-Site Scripting (XSS) and other common vulnerabilities, I recommend consulting the [WordPress Plugin Handbook's security section](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) or the [OWASP Top 10 Project](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F). These resources provide comprehensive guidance on implementing proper input sanitization, output escaping, and nonce verification to protect web applications.","The CF7 Views plugin fails to escape user-supplied submission data from Contact Form 7 when displaying it on the frontend via shortcodes. This allows an unauthenticated attacker to inject malicious JavaScript into a contact form, which then executes in the browser of any user (including administrators) who visits the page where the form submissions are displayed.","\u002F\u002F inc\u002Fclass-cf7-views-shortcode.php line 225\nif ( ! empty( $label && $view_type != 'table' ) ) {\n    $field_html .= '\u003Cdiv class=\"field-label\">' . $label . '\u003C\u002Fdiv>';\n}\n\n---\n\n\u002F\u002F inc\u002Fclass-cf7-views-shortcode.php line 267\n$field_value = apply_filters( 'cf7views-field-value', $field_value, $field, $view_settings, $sub );\n$field_html .= $field_value;","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.2\u002Fcf7-views.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.3\u002Fcf7-views.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.2\u002Fcf7-views.php\t2026-02-09 13:10:06.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.3\u002Fcf7-views.php\t2026-05-22 10:27:14.000000000 +0000\n@@ -3,7 +3,7 @@\n  * Plugin Name: CF7 Views\n  * Plugin URI: https:\u002F\u002Fcf7views.com\n  * Description: Display Contact Form 7 Submissions in frontend. Now includes built-in entry storage and management.\n- * Version: 3.2.2\n+ * Version: 3.2.3\n  * Author: WebHolics\n  * Author URI: https:\u002F\u002Fcf7views.com\n  * Text Domain: cf7-views\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.2\u002Finc\u002Fclass-cf7-views-shortcode.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.3\u002Finc\u002Fclass-cf7-views-shortcode.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.2\u002Finc\u002Fclass-cf7-views-shortcode.php\t2026-02-09 13:10:06.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcf7-views\u002F3.2.3\u002Finc\u002Fclass-cf7-views-shortcode.php\t2026-05-22 10:27:14.000000000 +0000\n@@ -131,7 +131,7 @@\n \tfunction get_table_content( $section_type, $view_settings, $submissions ) {\n \t\t$content      = '';\n \t\t$section_rows = $view_settings->sections->{$section_type}->rows;\n-\t\t$content      = ' \u003Cdiv class=\"cf7-views-cont cf7-views-' . $this->view_id . '-cont\"> \u003Ctable class=\"cf7-views-table cf7-view-' . $this->view_id . '-table pure-table pure-table-bordered\">';\n+\t\t$content      = ' \u003Cdiv class=\"cf7-views-cont cf7-views-' . esc_attr( $this->view_id ) . '-cont\"> \u003Ctable class=\"cf7-views-table cf7-view-' . esc_attr( $this->view_id ) . '-table pure-table pure-table-bordered\">';\n \t\t$content     .= '\u003Cthead>';\n \t\tforeach ( $submissions as $sub ) {\n \t\t\t$content .= '\u003Ctr>';\n@@ -195,7 +195,7 @@\n \t\t$column_size   = $view_settings->columns->{$column_id}->size;\n \t\t$column_fields = $view_settings->columns->{$column_id}->fields;\n \n-\t\t$column_content = '\u003Cdiv class=\"pure-u-1 pure-u-md-' . $column_size . '\">';\n+\t\t$column_content = '\u003Cdiv class=\"pure-u-1 pure-u-md-' . esc_attr( $column_size ) . '\">';\n \n \t\tforeach ( $column_fields as $field_id ) {\n \n@@ -216,16 +216,16 @@\n \t\t$field_html    = '';\n \t\tif ( $view_type == 'table' ) {\n \t\t\t$width       = ! empty( $field->fieldSettings->columnWidth ) ? $field->fieldSettings->columnWidth : 'auto';\n-\t\t\t$field_html .= '\u003Ctd  style=\"width:' . $width . '\">';\n+\t\t\t$field_html .= '\u003Ctd style=\"width:' . esc_attr( $width ) . '\">';\n \t\t}\n \n-\t\t$field_html .= '\u003Cdiv  class=\"cf7-view-field-cont  field-' . $form_field_id . ' ' . $class . '\">';\n+\t\t$field_html .= '\u003Cdiv class=\"cf7-view-field-cont field-' . esc_attr( $form_field_id ) . ' ' . esc_attr( $class ) . '\">';\n \n \t\t\u002F\u002F check if it's a form field\n \t\tif ( ! empty( $sub ) && is_object( $sub ) && ( $form_field_id !== 'entryId' && $form_field_id !== 'sequenceNumber' ) ) {\n \t\t\t\u002F\u002F if view type is table then don't send label\n \t\t\tif ( ! empty( $label && $view_type != 'table' ) ) {\n-\t\t\t\t$field_html .= '\u003Cdiv class=\"field-label\">' . $label . '\u003C\u002Fdiv>';\n+\t\t\t\t$field_html .= '\u003Cdiv class=\"field-label\">' . esc_html( $label ) . '\u003C\u002Fdiv>';\n \t\t\t}\n \t\t\t$form_field_type = isset( $this->form_fields[ $form_field_id ] ) ? $this->form_fields[ $form_field_id ]['type'] : $form_field_id;\n \t\t\t$field_value     = $this->get_field_value( $form_field_id, $sub );\n@@ -242,7 +242,7 @@\n \t\t\t\t\tforeach ( $value as $file ) {\n \t\t\t\t\t\tif ( isset( $fieldSettings->displayFileType ) && $fieldSettings->displayFileType == 'Image' ) {\n \t\t\t\t\t\t\t$width    = ! empty( $fieldSettings->imageWidth ) ? $fieldSettings->imageWidth : '100%';\n-\t\t\t\t\t\t\t$img_html = '\u003Cimg style=\"width:' . $width . '\" class=\"cf7-view-img\" src=\"' . wp_strip_all_tags( $file['path'] ) . '\">';\n+\t\t\t\t\t\t\t$img_html = '\u003Cimg style=\"width:' . esc_attr( $width ) . '\" class=\"cf7-view-img\" src=\"' . esc_url( $file['path'] ) . '\">';\n \n \t\t\t\t\t\t\tif ( isset( $fieldSettings->onClickAction ) && $fieldSettings->onClickAction == 'newTab' ) {\n \t\t\t\t\t\t\t\t$img_html = sprintf(\n@@ -255,7 +255,7 @@\n \t\t\t\t\t\t\t$img_html = sprintf(\n \t\t\t\t\t\t\t\t'\u003Ca href=\"%s\" rel=\"noopener\" target=\"_blank\">%s\u003C\u002Fa>',\n \t\t\t\t\t\t\t\tesc_url( $file['path'] ),\n-\t\t\t\t\t\t\t\tbasename( $file['path'] )\n+\t\t\t\t\t\t\t\tesc_html( basename( $file['path'] ) )\n \t\t\t\t\t\t\t);\n \t\t\t\t\t\t}\n \t\t\t\t\t}\n@@ -264,7 +264,7 @@\n \t\t\t}\n \n \t\t\t$field_value = apply_filters( 'cf7views-field-value', $field_value, $field, $view_settings, $sub );\n-\t\t\t$field_html .= $field_value;\n+\t\t\t$field_html .= esc_html( (string) $field_value );\n \t\t} else {\n \n \t\t\tswitch ( $form_field_id ) {\n@@ -276,12 +276,12 @@\n \t\t\t\t\tbreak;\n \t\t\t\tcase 'entryId':\n \t\t\t\t\t$field_html .= '\u003Cdiv class=\"cf7-view-field-value cf7-view-field-type-entryId-value\">';\n-\t\t\t\t\t$field_html .= $sub->id();\n+\t\t\t\t\t$field_html .= esc_html( $sub->id() );\n \t\t\t\t\t$field_html .= '\u003C\u002Fdiv>';\n \t\t\t\t\tbreak;\n \t\t\t\tcase 'sequenceNumber':\n \t\t\t\t\t$field_html .= '\u003Cdiv class=\"cf7-view-field-value cf7-view-field-type-sequenceNumber-value\">';\n-\t\t\t\t\t$field_html .= $this->seq_no;\n+\t\t\t\t\t$field_html .= esc_html( $this->seq_no );\n \t\t\t\t\t$field_html .= '\u003C\u002Fdiv>';\n \t\t\t\t\tbreak;\n \t\t\t}\n@@ -301,8 +301,8 @@\n \t\t$label         = $fieldSettings->useCustomLabel ? $fieldSettings->label : $field->label;\n \t\t$width         = ! empty( $field->fieldSettings->columnWidth ) ? $field->fieldSettings->columnWidth : 'auto';\n \t\t$header        = '\u003Cth>';\n-\t\t$header       .= '\u003Cdiv style=\"width:' . $width . '\" class=\"cf7-views-table-header \">';\n-\t\t$header       .= $label;\n+\t\t$header       .= '\u003Cdiv style=\"width:' . esc_attr( $width ) . '\" class=\"cf7-views-table-header \">';\n+\t\t$header       .= esc_html( $label );\n \t\t$header       .= '\u003C\u002Fdiv>';\n \t\t$header       .= '\u003C\u002Fth>';\n \t\treturn $header;","1. Identify a WordPress site running Contact Form 7 and the CF7 Views plugin.\n2. Locate a public-facing Contact Form 7 form that is configured to be displayed via a CF7 Views shortcode (e.g., `[cf7-views id=\"123\"]`).\n3. Submit the contact form as an unauthenticated visitor, placing a JavaScript payload (e.g., `\u003Cscript>alert('XSS')\u003C\u002Fscript>`) into any of the available input fields.\n4. Wait for a site administrator or any other user to visit the page where the CF7 Views shortcode renders the submission entries.\n5. Because the plugin outputs the stored field values directly without using `esc_html()`, the payload will execute in the context of the victim's session.","gemini-3-flash-preview","2026-07-16 14:49:23","2026-07-16 14:50:13",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","3.2.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcf7-views\u002Ftags\u002F3.2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcf7-views.3.2.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcf7-views\u002Ftags\u002F3.2.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcf7-views.3.2.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcf7-views\u002Ftags"]