WordPress Plugin Vulnerabilities

Contact Form 7 Database Addon < 1.3.2 - Unauthenticated Stored XSS via tmpD Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
contact-form-cfdb7
Fixed in 1.3.2

References

CVE
CVE-2025-6740
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/014803c8-3319-48ad-98c7-d1f372d37ff2

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Phat RiO - BlueRock
Verified
No
WPVDB ID
7602fe14-46b0-4334-980e-8b3601afaf43

Timeline

Publicly Published
2025-07-03 (about 10 months ago)
Added
2025-07-04 (about 10 months ago)
Last Updated
2025-07-04 (about 10 months ago)

Other

Published
Title
Published
2025-05-07
Title
Ultimate Blocks < 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2015-06-30
Title
WP-CopyProtect < 3.1.0 - CSRF & Stored Cross-Site Scripting (XSS)
Published
2025-01-07
Title
Boot-Modal < 1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-24
Title
Inline frame – Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2021-07-24
Title
Email Subscriber <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)