CVE-2026-15735: WordPress Contact Form to Any API XSS Flaw

CVE-2026-15735 Overview

CVE-2026-15735 is a stored cross-site scripting (XSS) vulnerability in the Contact Form to Any API plugin for WordPress. The flaw affects all versions of the plugin up to and including 3.0.6. The issue resides in the handling of the cf7anyapi_form_field post meta value, where the plugin fails to sanitize input or escape output. Authenticated users with contributor-level access or above can inject arbitrary JavaScript that executes in the browser of any visitor rendering the affected page. The vulnerability is tracked under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that runs against every user visiting an affected page, enabling session theft, account takeover, and administrative action forgery.

Affected Products

Contact Form to Any API plugin for WordPress — all versions ≤ 3.0.6
WordPress sites permitting contributor-level registration or higher
Any downstream site embedding pages that render cf7anyapi_form_field post meta

Discovery Timeline

2026-07-29 - CVE-2026-15735 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15735

Vulnerability Analysis

The Contact Form to Any API plugin stores form configuration data as WordPress post meta under the cf7anyapi_form_field key. When plugin administration or public-facing views render this metadata, the values are emitted into HTML output without applying sanitization functions such as sanitize_text_field() or output escaping helpers like esc_html(), esc_attr(), or wp_kses().

Because the metadata persists in the database and is rendered on subsequent page loads, injected payloads execute in the security context of every user who views the page. Contributor-level accounts, which WordPress permits to create draft content and edit their own posts, satisfy the privilege requirement. The scope is marked as changed because scripts run against victim browsers outside the vulnerable component's authority.

Root Cause

The root cause is insufficient input sanitization on write and missing output escaping on render. The vulnerable code paths are visible in the plugin source at admin/class-cf7-to-any-api-admin.php lines 334, 519, and 604 in the tagged 3.0.6 release. See the WordPress Plugin Code Snippet for the affected implementation.

Attack Vector

An attacker authenticates to WordPress with a contributor role or higher. The attacker submits a crafted payload targeting the cf7anyapi_form_field post meta field through the plugin's administrative interfaces. The payload is stored to the database without neutralization. When any user, including higher-privileged administrators, loads a page that renders the affected metadata, the injected script executes in their browser session. This enables cookie theft, CSRF token exfiltration, forced administrative actions, and pivoting toward full site takeover.

Refer to the Wordfence Vulnerability Intelligence entry and the WordPress Plugin Change Set for the vendor fix details.

Detection Methods for CVE-2026-15735

Indicators of Compromise

Post meta entries under the cf7anyapi_form_field key containing <script>, onerror=, onload=, javascript:, or encoded equivalents
Unexpected outbound requests from administrator browser sessions to attacker-controlled domains shortly after visiting plugin-managed pages
New administrator accounts or role escalations following contributor account activity
Modification of plugin configuration or wp_options values without a corresponding legitimate administrator session

Detection Strategies

Query the wp_postmeta table for rows where meta_key = 'cf7anyapi_form_field' and the meta_value contains HTML tags or JavaScript event handlers
Enable WordPress audit logging to record contributor-level post meta writes and correlate with plugin endpoints
Deploy a web application firewall rule that inspects requests to plugin admin endpoints for XSS payload signatures
Monitor browser Content Security Policy (CSP) violation reports for inline-script or eval violations sourced from plugin-rendered pages

Monitoring Recommendations

Alert on contributor and author role account creation followed by immediate plugin configuration writes
Track HTTP referer patterns showing administrative page loads that trigger outbound cross-origin requests
Baseline the frequency of cf7anyapi_form_field updates and flag anomalous write spikes
Review WordPress user_meta and usermeta tables for privilege changes tied to contributor sessions

How to Mitigate CVE-2026-15735

Immediate Actions Required

Upgrade the Contact Form to Any API plugin to a version above 3.0.6 as soon as the vendor publishes a fixed release
Audit existing cf7anyapi_form_field post meta values and remove entries containing script content or HTML event handlers
Restrict contributor and author role assignments to trusted users only and disable open registration where feasible
Rotate administrator session cookies and force password resets if suspicious meta writes are identified

Patch Information

The vendor change set is tracked at the WordPress Plugin Change Set. Administrators should apply the fixed release through the WordPress plugin update mechanism once available and verify the plugin version in wp-admin reports 3.0.7 or later.

Workarounds

Temporarily deactivate the Contact Form to Any API plugin until a patched version is installed
Reduce contributor accounts to subscriber role or lower to eliminate the required privilege
Deploy a Content Security Policy (CSP) header that disallows inline scripts and restricts script sources to trusted origins
Add a WAF virtual patch that blocks POST requests to plugin admin endpoints containing <, >, or on\w+= patterns in the cf7anyapi_form_field parameter

bash

# Content Security Policy example to mitigate stored XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report"

# WP-CLI query to identify potentially malicious post meta values
wp db query "SELECT post_id, meta_value FROM wp_postmeta WHERE meta_key='cf7anyapi_form_field' AND (meta_value LIKE '%<script%' OR meta_value LIKE '%onerror=%' OR meta_value LIKE '%javascript:%');"