Description

Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T17:17:24.410Z",
  "pubdate": "2026-09-03T17:17:24.410Z",
  "executiveSummary": "The 'Calculation For Contact Form 7' plugin, specifically versions 1.0 and below, contains a critical security vulnerability categorized as Unauthenticated Reflected Cross-Site Scripting (XSS).\nThis vulnerability allows unauthenticated remote attackers to inject malicious JavaScript into the web application, which is then executed within the security context of the victim's browser.\nBecause the flaw is unauthenticated, no prior access or user privileges are required to initiate an attack, significantly increasing the risk profile.\nSuccessful exploitation permits a wide array of malicious activities, including session hijacking, redirection to malicious domains, unauthorized data exfiltration, or the defacement of the affected WordPress site.\nThe vulnerability highlights a failure in the plugin to properly sanitize user-supplied input before rendering it back to the client, effectively bypassing the browser's Same-Origin Policy (SOP).\nOrganizations relying on this plugin are at high risk of client-side attacks, potentially compromising user credentials and administrative sessions.",
  "technicalDetails": "The vulnerability resides within the request handling mechanism of the 'Calculation For Contact Form 7' plugin, which fails to implement adequate input validation or output encoding on parameters processed during the calculation phase.\nThe root cause is the improper handling of user-supplied data that is reflected directly into the Document Object Model (DOM) of the generated page. By failing to sanitize specific HTTP request parameters, the plugin allows an attacker to inject arbitrary HTML and JavaScript tags into the application response.\nThe attack flow begins when an unauthenticated attacker crafts a malicious URL containing a payload designed to break out of the intended HTML context. When a victim, such as an authenticated administrator or a general user, visits the crafted URL, the server processes the input and includes the attacker's script in the HTTP response.\nThe browser, interpreting the server's response as trusted content, executes the injected script. Since the attack is performed without authentication, the payload can be delivered to any user who clicks a link, or automatically via automated probes scanning for reachable injection points within the plugin's endpoints.\nOnce the payload executes, it operates under the authority of the victim's session. For an administrative user, this could lead to the silent creation of new admin accounts, modification of plugin configurations, or the exfiltration of sensitive site data through an asynchronous request back to an attacker-controlled server.\nThe lack of authentication requirements facilitates large-scale automated exploitation, as the attacker does not need to bypass login screens or possess legitimate site credentials to trigger the reflected script. The vulnerability persists across all documented versions up to 1.0, indicating a systemic flaw in the plugin's data processing logic."
}