CVE-2026-13359 Overview
CVE-2026-13359 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Contact Form to DB by BestWebSoft – Messages Database Plugin for WordPress. The flaw affects all plugin versions up to and including 1.7.5. Unauthenticated attackers can inject arbitrary JavaScript through the cntctfrm_contact_dropdown parameter due to insufficient input sanitization and output escaping. The injected payload executes in the administrator's browser session when they view the plugin's message manager page at /wp-admin/admin.php?page=cntctfrmtdb_manager. Successful exploitation can lead to administrator session compromise from a simple contact form submission.
Critical Impact
Unauthenticated attackers can execute arbitrary scripts in an administrator's authenticated browser context by submitting a crafted contact form, enabling account takeover of the WordPress site.
Affected Products
- Contact Form to DB by BestWebSoft – Messages Database Plugin for WordPress
- All versions up to and including 1.7.5
- WordPress sites with the plugin activated and accessible contact forms
Discovery Timeline
- 2026-09-09 - CVE-2026-13359 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-13359
Vulnerability Analysis
The vulnerability resides in how the Contact Form to DB plugin processes the cntctfrm_contact_dropdown form field. When a visitor submits a contact form, the plugin stores the submitted dropdown value in the database without sufficient sanitization. When an administrator later opens the plugin's message manager view, the stored value is rendered without proper output escaping. This produces a classic stored XSS condition where attacker-controlled input executes as script in a privileged browser context.
Because the injection point is a public contact form, no authentication is required to plant the payload. The victim is the administrator who reviews submitted messages, meaning execution occurs within a session that holds full WordPress administrative privileges. This scope change from unauthenticated attacker to administrator context is what elevates the impact of the flaw.
Root Cause
The root cause is missing input sanitization on the cntctfrm_contact_dropdown parameter during form submission handling and missing output escaping when rendering the value on the message manager page. Reviewers can inspect the affected code paths in the plugin source at lines 582 and 2035 of contact_form_to_db.php referenced in the WordPress Plugin Code Review at line 582 and the WordPress Plugin Code Review at line 2035.
Attack Vector
An attacker locates any public page hosting a form generated by the vulnerable plugin. The attacker submits the form with a JavaScript payload placed into the cntctfrm_contact_dropdown field. The payload is persisted in the WordPress database as a stored contact message. When a site administrator visits /wp-admin/admin.php?page=cntctfrmtdb_manager to review submissions, the browser renders the unescaped value and executes the script. The attacker can then perform actions such as creating administrator accounts, modifying content, or exfiltrating session cookies.
A sanitized description of the payload flow: the attacker submits a form field containing an HTML element that carries a JavaScript event handler. The stored value is later inlined into the admin page markup, and the browser executes the handler as trusted first-party script within the WordPress admin origin. See the Wordfence Vulnerability Report for additional detail.
Detection Methods for CVE-2026-13359
Indicators of Compromise
- Contact form submissions where the cntctfrm_contact_dropdown value contains HTML tags, <script>, on*= event handlers, javascript: URIs, or encoded variants.
- Unexpected new WordPress administrator accounts, modified user roles, or altered plugin and theme files following administrator visits to the message manager page.
- Outbound HTTP requests from administrator browser sessions to unknown domains shortly after loading /wp-admin/admin.php?page=cntctfrmtdb_manager.
Detection Strategies
- Review the plugin's stored messages table for entries whose cntctfrm_contact_dropdown field contains characters such as <, >, ", or ', or strings like script, onerror, or onload.
- Inspect web server access logs for POST requests to contact form endpoints containing suspicious payloads in form parameters.
- Correlate WordPress audit logs of administrator actions with recent visits to the plugin manager page to identify anomalous privilege changes.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record administrator sessions, user creation, and role changes.
- Deploy a Web Application Firewall (WAF) rule that inspects and blocks script-like content in contact form parameters.
- Monitor Content Security Policy (CSP) violation reports from the /wp-admin/ origin for inline script execution events.
How to Mitigate CVE-2026-13359
Immediate Actions Required
- Update the Contact Form to DB plugin to a version later than 1.7.5 that includes the fix from WordPress Plugin Changeset 3624996.
- Audit the plugin's stored messages table and remove any entries containing script payloads or suspicious HTML in the cntctfrm_contact_dropdown field.
- Rotate WordPress administrator passwords and invalidate active sessions if the message manager page was accessed while vulnerable versions were installed.
- Review the WordPress user list for unauthorized administrator accounts and revert unexpected role changes.
Patch Information
The vendor addressed the vulnerability in the changeset published at WordPress Plugin Changeset 3624996. Administrators should upgrade to the fixed release available through the WordPress plugin repository. Confirm the installed version is newer than 1.7.5 after the update completes.
Workarounds
- Deactivate and remove the Contact Form to DB plugin until the update can be applied.
- Restrict access to /wp-admin/admin.php?page=cntctfrmtdb_manager using web server access controls or an admin-IP allowlist.
- Deploy a WAF rule that strips or blocks HTML tags and event-handler attributes in the cntctfrm_contact_dropdown parameter of contact form submissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
