[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fu8yYVM8i3SCSBfMC__F4H70e4JdfvXXh5qfnLlkw9nU":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-23970","redirection-for-contact-form-7-unauthenticated-stored-cross-site-scripting","Redirection for Contact Form 7 \u003C= 3.2.8 - Unauthenticated Stored Cross-Site Scripting","The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","wpcf7-redirect",null,"\u003C=3.2.8","3.2.9","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-05-13 00:00:00","2026-05-19 13:33:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F431a83b3-4dc9-4090-ae49-1c283d24fc2e?source=api-prod",7,[22,23,24,25],"classes\u002Factions\u002Fclass-wpcf7r-action-firescript.php","readme.txt","vendor\u002Fcomposer\u002Finstalled.php","wpcf7-redirect.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-23970\n\n## 1. Vulnerability Summary\nThe **Redirection for Contact Form 7** plugin (\u003C= 3.2.8) contains an unauthenticated stored cross-site scripting (XSS) vulnerability. The plugin's AJAX handler for saving form-specific \"Submission Actions\" (specifically the `FireScript` action type) fails to perform any authorization checks or nonce verification. This allows an unauthenticated attacker to update the metadata of any Contact Form 7 form to include arbitrary JavaScript. This script is then executed in the context of any user who submits the form, as the plugin fails to sanitize or escape the stored script before outputting it to the frontend.\n\n## 2. Attack Vector Analysis\n- **Vulnerable Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action:** `wpcf7r_save_actions` (inferred from plugin architecture for managing multiple actions).\n- **Vulnerable Parameter:** `actions` (specifically the `script` key within the action settings).\n- **Authentication Required:** None (Unauthenticated).\n- **Preconditions:** \n    1. A Contact Form 7 form must exist (ID must be known).\n    2. The \"Legacy Fire Script\" feature must be enabled (often the case on upgraded sites or explicitly via the `wpcf7_redirect_legacy_fire_script` option).\n\n## 3. Code Flow\n1. **Entry Point:** An unauthenticated POST request is sent to `admin-ajax.php?action=wpcf7r_save_actions`.\n2. **Missing Check:** The handler (likely in `classes\u002Fclass-wpcf7r-actions.php`) is invoked. It lacks a `current_user_can('manage_options')` check and does not call `check_ajax_referer()`.\n3. **Storage:** The handler iterates through the `actions` parameter and updates the form's metadata (e.g., `_wpcf7r_actions`) using `update_post_meta()` based on the provided `form_id`.\n4. **Trigger:** A user navigates to a page containing the form and submits it.\n5. **Retrieval:** The plugin's submission handler retrieves the actions for that form ID.\n6. **Processing:** For the `FireScript` action, `WPCF7R_Action_FireScript::process($submission)` is called (as seen in `classes\u002Factions\u002Fclass-wpcf7r-action-firescript.php`).\n7. **Sink:** The `process` method returns the raw `$script` value obtained via `$this->get( 'script' )`. This value is then either printed directly into a `\u003Cscript>` tag in the response or returned via an AJAX feedback response and executed via `eval()` in the browser.\n\n## 4. Nonce Acquisition Strategy\nThis vulnerability is classified as **unauthenticated**, implying that the vulnerable AJAX handler either uses the `wp_ajax_nopriv_` prefix or simply omits the nonce check. \n\nIf a nonce were required, it would typically be localized via `wp_localize_script`.\n1. **Script Variable:** `wpcf7r_vars` (inferred).\n2. **Extraction:**\n   ```javascript\n   browser_eval(\"window.wpcf7r_vars?.nonce\")\n   ```\nHowever, the primary exploitation path assumes the nonce check is entirely absent in the vulnerable version.\n\n## 5. Exploitation Strategy\n1. **Target Identification:** Locate a CF7 form on the site and extract the form ID (e.g., `101`) from the `wpcf7-f101-p...` class in the HTML.\n2. **Precondition Setup:** Use WP-CLI to ensure the FireScript action is active (simulating a legacy install):\n   ```bash\n   wp option update wpcf7_redirect_legacy_fire_script yes\n   ```\n3. **Payload Construction:** Create a POST request to update the form actions.\n   - **Action:** `wpcf7r_save_actions`\n   - **Form ID:** `101`\n   - **Actions Payload:** A structure representing a `FireScript` action containing the XSS payload.\n4. **Execution (HTTP Request):**\n   ```http\n   POST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\n   Content-Type: application\u002Fx-www-form-urlencoded\n\n   action=wpcf7r_save_actions&form_id=101&actions[0][action_type]=FireScript&actions[0][active]=true&actions[0][script]=alert(document.domain)\n   ```\n5. **Trigger XSS:** Navigate to the form page and click \"Submit\". The browser should execute `alert(document.domain)`.\n\n## 6. Test Data Setup\n1. **Plugins:** Install `contact-form-7` and `wpcf7-redirect` (v3.2.8).\n2. **Create Form:**\n   ```bash\n   wp post create --post_type=wpcf7_contact_form --post_title=\"Vulnerable Form\" --post_status=publish\n   # Assume ID is 101\n   ```\n3. **Create Page:**\n   ```bash\n   wp post create --post_type=page --post_title=\"Contact Us\" --post_status=publish --post_content='[contact-form-7 id=\"101\"]'\n   ```\n4. **Enable FireScript:**\n   ```bash\n   wp option update wpcf7_redirect_legacy_fire_script yes\n   ```\n\n## 7. Expected Results\n- The AJAX call to `wpcf7r_save_actions` returns a success response (e.g., `{\"success\":true}`).\n- The `_wpcf7r_actions` metadata for the form is updated with the XSS payload.\n- Upon form submission, the browser executes the injected JavaScript.\n\n## 8. Verification Steps\n1. **Check Meta:**\n   ```bash\n   wp post meta get 101 _wpcf7r_actions\n   ```\n   Verify that the output contains the string `alert(document.","The Redirection for Contact Form 7 plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) due to a lack of authorization and nonce validation in its AJAX handler for saving form actions. This allows an attacker to inject arbitrary JavaScript into a Contact Form 7 form's submission process, which executes in the context of any user who submits the form because the script is stored and later output without sufficient sanitization.","\u002F\u002F classes\u002Factions\u002Fclass-wpcf7r-action-firescript.php line 108\n\tpublic function process( $submission ) {\n\n\t\t$script = $this->get( 'script' );\n\n\t\t$script = $this->replace_tags( $script, array() );\n\n\t\treturn $script;\n\t}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwpcf7-redirect\u002F3.2.8\u002Fclasses\u002Factions\u002Fclass-wpcf7r-action-firescript.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwpcf7-redirect\u002F3.2.9\u002Fclasses\u002Factions\u002Fclass-wpcf7r-action-firescript.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwpcf7-redirect\u002F3.2.8\u002Fclasses\u002Factions\u002Fclass-wpcf7r-action-firescript.php\t2025-04-23 13:52:14.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fwpcf7-redirect\u002F3.2.9\u002Fclasses\u002Factions\u002Fclass-wpcf7r-action-firescript.php\t2026-02-10 10:48:56.000000000 +0000\n@@ -108,7 +108,7 @@\n \n \t\t$script = $this->get( 'script' );\n \n-\t\t$script = $this->replace_tags( $script, array() );\n+\t\t$script = $this->replace_tags( $script, true );\n \n \t\treturn $script;\n \t}","1. Identify the post ID of an active Contact Form 7 form on the target WordPress site (found in the HTML source via classes like 'wpcf7-f101-p...').\n2. Send an unauthenticated POST request to `\u002Fwp-admin\u002Fadmin-ajax.php?action=wpcf7r_save_actions` with the `form_id` and an `actions` array.\n3. The payload should define a `FireScript` action type and include malicious JavaScript in the `script` parameter (e.g., `actions[0][action_type]=FireScript&actions[0][active]=true&actions[0][script]=alert(document.domain)`).\n4. The plugin, lacking permission checks, updates the form's metadata with the provided script.\n5. When any user visits the site and submits that form, the plugin's submission handler retrieves the injected script and executes it in the user's browser context.","gemini-3-flash-preview","2026-05-20 17:55:48","2026-05-20 17:57:43",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","3.2.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpcf7-redirect\u002Ftags\u002F3.2.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwpcf7-redirect.3.2.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpcf7-redirect\u002Ftags\u002F3.2.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwpcf7-redirect.3.2.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpcf7-redirect\u002Ftags"]