[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUeWaCCM5fQFwnkoQynuduMnfaoouTLjya3H0cP-c2hY":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":28,"research_verified":29,"research_rounds_completed":30,"research_plan":31,"research_summary":32,"research_vulnerable_code":33,"research_fix_diff":34,"research_exploit_outline":35,"research_model_used":36,"research_started_at":37,"research_completed_at":38,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":29,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":29,"source_links":39},"CVE-2026-57423","message-filter-for-contact-form-7-reflected-cross-site-scripting-2","Message Filter for Contact Form 7 \u003C= 1.6.3.8 - Reflected Cross-Site Scripting","The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.6.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","cf7-message-filter",null,"\u003C=1.6.3.8","1.6.3.9","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-08 00:00:00","2026-07-14 19:23:46",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F5b4f2862-c340-4637-accb-8f1ae6e432ea?source=api-prod",7,[22,23,24,25,26,27],"README.txt","cf7-message-filter.php","config.env","core\u002FKMCFMessageFilter.php","freemius\u002Fassets\u002Fjs\u002Fpricing\u002F4529cac82a2d1f300d3c4702b7b5e8f3.svg","freemius\u002Fassets\u002Fjs\u002Fpricing\u002F5480ed23b199531a8cbc05924f26952b.png","researched",false,3,"## 1. Vulnerability Summary\nThe **Message Filter for Contact Form 7** plugin (versions \u003C= 1.6.3.8) is vulnerable to **Reflected Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin fails to sanitize or escape user-supplied input from URL parameters before echoing it back into the HTML of the administrative dashboard. Specifically, the `KMCF7ErrorNotice` function in `cf7-message-filter.php` is registered to the `admin_notices` hook and explicitly echoes its first argument without any neutralization. If any plugin logic or common admin patterns reflect a `$_GET` parameter (like `tab`, `page`, or `message`) through this notice system or within the settings page views, an attacker can execute arbitrary JavaScript in the context of an authenticated administrator.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin.php`\n*   **Vulnerable Page:** The settings pages registered by the plugin, specifically `page=kmcf7-message-filter-options` or the main page `page=kmcf7-message-filter`.\n*   **Vulnerable Parameter:** `tab` (highly likely based on `KMCFMessageFilter.php` line 185) or `message`.\n*   **Authentication:** Requires **Administrator** privileges to trigger the payload execution (as it occurs in the admin area), but the attack is **unauthenticated** in the sense that an attacker can generate and send the malicious link to a victim without needing","The Message Filter for Contact Form 7 plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to the failure to properly sanitize and escape input passed to the KMCF7ErrorNotice function. An unauthenticated attacker can execute arbitrary JavaScript in the context of an administrator's browser by tricking them into clicking a link with a malicious payload that is reflected in the administrative dashboard.","\u002F* cf7-message-filter.php lines 97-105 *\u002F\nfunction KMCF7ErrorNotice(  $message = ''  ) {\n    if ( trim( $message ) != '' ) {\n        ?>\n        \u003Cdiv class=\"error notice is-dismissible\">\n            \u003Cp>\u003Cb>CF7 Message Filter: \u003C\u002Fb>\u003C?php \n        echo $message;\n        ?>\u003C\u002Fp>\n        \u003C\u002Fdiv>\n\t\u003C?php \n    }\n}","--- cf7-message-filter.php\n+++ cf7-message-filter.php\n@@ -9,7 +9,7 @@\n  * Plugin Name: Message Filter for Contact Form 7\n  * Plugin URI: https:\u002F\u002Fgithub.com\u002Fkofimokome\u002Fcf7-message-filter\n  * Description: Filters messages submitted from contact form 7 if it has words or email marked as spam by the user\n- * Version: 1.6.3.8\n+ * Version: 1.6.3.9\n  * Author: Kofi Mokome\n  * Author URI: https:\u002F\u002Fwww.kofimokome.stream\n  * License: GPL-2.0+\n@@ -100,7 +100,7 @@\n             \u003Cdiv class=\"error notice is-dismissible\">\n                 \u003Cp>\u003Cb>CF7 Message Filter: \u003C\u002Fb>\u003C?php \n-            echo $message;\n+            echo wp_kses_post( $message );\n             ?>\u003C\u002Fp>\n             \u003C\u002Fdiv>\n \t\t\u003C?php","1. The attacker identifies that the KMCF7ErrorNotice function in cf7-message-filter.php echoes its input directly into the HTML of the admin dashboard without neutralization.\n2. The attacker crafts a URL targeting a plugin administrative page (e.g., wp-admin\u002Fadmin.php?page=kmcf7-message-filter) that includes a malicious JavaScript payload in a parameter likely to be reflected via notices (such as 'message' or 'tab').\n3. The attacker tricks an authenticated administrator into clicking the crafted malicious link using social engineering.\n4. When the administrator visits the link, the WordPress 'admin_notices' hook triggers the KMCF7ErrorNotice function, which renders the unescaped script payload into the administrative interface, executing it in the victim's session context.","gemini-3-flash-preview","2026-07-16 15:17:58","2026-07-16 15:19:30",{"type":40,"vulnerable_version":41,"fixed_version":11,"vulnerable_browse":42,"vulnerable_zip":43,"fixed_browse":44,"fixed_zip":45,"all_tags":46},"plugin","1.6.3.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcf7-message-filter\u002Ftags\u002F1.6.3.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcf7-message-filter.1.6.3.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcf7-message-filter\u002Ftags\u002F1.6.3.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fcf7-message-filter.1.6.3.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fcf7-message-filter\u002Ftags"]