CVE-2026-112379: Contact Form Email Stored XSS Vulnerability

CVE-2026-112379 Overview

CVE-2026-112379 is a stored Cross-Site Scripting (XSS) vulnerability in the Codepeople Contact Form Email plugin for WordPress, tracked as contact-form-to-email. The flaw affects all plugin versions up to and including 1.3.68. Attackers can inject malicious scripts that persist in the application and execute in the browser context of any user who views the affected page.

The vulnerability stems from improper neutralization of input during web page generation [CWE-79]. Exploitation requires user interaction, but no authentication is needed to deliver the payload. A successful attack can lead to session theft, credential harvesting, or redirection to attacker-controlled infrastructure.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes against site visitors and administrators, enabling account takeover and privilege escalation workflows.

Affected Products

Codepeople Contact Form Email plugin (contact-form-to-email) for WordPress
All versions from n/a through 1.3.68
WordPress sites using the plugin for contact form submissions and email delivery

Discovery Timeline

2026-10-22 - CVE-2026-112379 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-112379

Vulnerability Analysis

The Contact Form Email plugin fails to properly neutralize user-supplied input before rendering it in generated web pages. This classifies the issue as stored XSS, meaning injected content persists in the WordPress database and executes whenever an affected page loads. Because the scope is Changed, the injected payload can affect resources beyond the vulnerable component, including administrator sessions.

The attack vector is network-based with low complexity. The attacker needs no privileges but relies on a victim visiting the page containing the stored payload. Confidentiality, integrity, and availability all take low-magnitude impact in isolation, but chained with administrative session hijacking the practical impact escalates significantly.

Root Cause

The plugin accepts form submission data or configuration input and writes it to persistent storage without sufficient output encoding when later rendered. Fields that should be treated as text are instead reflected into HTML or JavaScript contexts, allowing <script> tags and event handlers to execute.

Attack Vector

An unauthenticated attacker submits a crafted contact form entry or targets another plugin surface that stores unsanitized input. When a privileged user, typically a WordPress administrator reviewing submissions, loads the affected view, the browser executes the injected payload under the site's origin. The payload can issue authenticated requests, exfiltrate cookies not marked HttpOnly, or modify site content.

Technical specifics are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-112379

Indicators of Compromise

Unexpected <script> tags, onerror, onload, or javascript: strings stored in wp_postmeta, wp_options, or plugin-specific tables tied to contact-form-to-email.
Outbound requests from administrator browsers to unknown domains shortly after loading plugin admin pages.
New or modified WordPress administrator accounts created without a corresponding audit log entry.
Form submission entries containing encoded JavaScript payloads such as %3Cscript%3E or base64-encoded strings.

Detection Strategies

Query the WordPress database for stored form submissions containing HTML tags or JavaScript syntax in fields expected to contain plain text.
Deploy a Web Application Firewall rule to flag POST requests to Contact Form Email endpoints containing script-like payloads.
Review browser console telemetry and Content Security Policy violation reports from administrator sessions.

Monitoring Recommendations

Enable WordPress audit logging for plugin option changes and user role modifications.
Monitor web server access logs for POST requests to contact-form-to-email endpoints followed by GET requests from authenticated admin IP addresses.
Correlate anomalous administrator activity, such as off-hours logins or privilege changes, with recent form submissions.

How to Mitigate CVE-2026-112379

Immediate Actions Required

Update the Contact Form Email plugin to the latest version released after 1.3.68 as soon as the vendor publishes a fix.
Audit all stored form submissions and plugin configuration data for suspicious HTML or script content and remove it.
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected.
Review the WordPress user table for unauthorized accounts added since the plugin was installed.

Patch Information

Refer to the Patchstack Vulnerability Report for the latest remediation guidance and fixed version information from Codepeople. Until a patched release is confirmed, treat the plugin as vulnerable in all versions through 1.3.68.

Workarounds

Deactivate and remove the contact-form-to-email plugin until a patched release is available.
Deploy a WordPress-aware Web Application Firewall with XSS filtering rules for plugin endpoints.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Restrict administrative access to the WordPress dashboard by IP allowlist to reduce exposure for stored payload execution.

bash

# Example: temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate contact-form-to-email
wp plugin delete contact-form-to-email

# Audit database for suspicious stored payloads
wp db query "SELECT * FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%onerror=%';"