CVE-2026-1045: Viet Contact WordPress Plugin XSS Flaw

CVE-2026-1045 Overview

The Viet Contact plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the admin settings functionality. All versions up to and including 1.3.2 are affected due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers with administrator privileges can persistently inject malicious scripts that execute in the context of other users' browser sessions, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

Affected Products

• Viet Contact WordPress Plugin versions up to and including 1.3.2
• WordPress Multi-site installations with the Viet Contact plugin
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-01-20 - CVE-2026-1045 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2026-1045

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists within the Viet Contact plugin's administrative settings interface. The root cause stems from the plugin failing to properly sanitize user-supplied input before storing it in the database, combined with insufficient output escaping when rendering stored values back to the page.

The attack requires network access and administrator-level authentication, making the attack complexity higher than typical XSS vulnerabilities. However, the impact extends beyond the attacker's session scope, as injected scripts persist and execute for any user viewing the affected pages. This is particularly dangerous in multi-site WordPress environments or installations where the unfiltered_html capability has been explicitly disabled, as these configurations are typically implemented to prevent exactly this type of attack.

Root Cause

The vulnerability originates from improper handling of admin settings input in the plugin's core files. Specifically, the vietcontact-admin.php file at line 34 and vietcontact-content.php at line 11 contain code paths that fail to implement proper sanitization functions like sanitize_text_field() or escaping functions like esc_html() and esc_attr() when processing and displaying user-controlled data. This allows malicious JavaScript payloads to be stored in the database and subsequently rendered in the HTML output without proper encoding.

Attack Vector

An authenticated administrator can exploit this vulnerability by navigating to the Viet Contact plugin settings page and injecting malicious JavaScript code into one of the vulnerable input fields. The malicious payload is stored in the WordPress database without sanitization. When any user subsequently views a page that renders this stored content, the injected script executes in their browser context.

The attack scenario is limited to environments where administrators should not have the ability to inject arbitrary scripts—specifically multi-site installations where super-admin controls are enforced, or single-site installations that have explicitly disabled unfiltered_html to prevent such attacks from privileged users.

For detailed technical analysis of the vulnerable code paths, refer to the WordPress Plugin Code Review for vietcontact-admin.php and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-1045

Indicators of Compromise

• Unexpected JavaScript code present in Viet Contact plugin settings stored in the wp_options database table
• Suspicious admin activity logs showing repeated access to plugin settings pages
• User reports of unexpected browser behavior or redirects when viewing pages containing Viet Contact forms
• Presence of encoded or obfuscated script tags within plugin configuration values

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to WordPress admin pages
• Monitor WordPress database for stored script tags or event handlers in plugin option values
• Deploy Content Security Policy (CSP) headers to detect and block inline script execution
• Use browser-based XSS auditors and security extensions to identify malicious script injection attempts

Monitoring Recommendations

• Enable and review WordPress admin activity logs for unusual plugin settings modifications
• Configure alerting for changes to Viet Contact plugin options in the database
• Implement file integrity monitoring on plugin files to detect unauthorized modifications
• Regularly audit user accounts with administrator privileges for unauthorized access

How to Mitigate CVE-2026-1045

Immediate Actions Required

• Update the Viet Contact plugin to a patched version when available from the WordPress plugin repository
• Review and remove any suspicious content from Viet Contact plugin settings
• Audit administrator user accounts and revoke access for any compromised or unnecessary admin accounts
• Implement a Web Application Firewall with XSS protection rules

Patch Information

As of the published date, users should monitor the WordPress Plugin Repository for an updated version of the Viet Contact plugin that addresses this vulnerability. The fix should implement proper input sanitization using WordPress sanitization functions and output escaping using appropriate escaping functions for the context.

Workarounds

• Temporarily deactivate the Viet Contact plugin until a patched version is available
• Restrict administrator access to only trusted users on multi-site installations
• Implement Content Security Policy headers to mitigate the impact of any injected scripts
• Consider using alternative contact form plugins that have undergone security audits

# Configuration example - Add CSP header to mitigate XSS impact
# Add to .htaccess or server configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"