CVE-2026-97661: WordPress Contact Form 7 XSS Vulnerability

CVE-2026-97661 Overview

The Business Essentials for Contact Form 7 plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the gateway form field. The flaw affects all versions up to and including 1.2.1 and results from insufficient input sanitization and output escaping [CWE-79]. Unauthenticated attackers can inject arbitrary web scripts that execute when any user accesses an affected page. Exploitation requires the Payments module to be enabled and a form configured to accept both PayPal and Stripe as payment gateways. The vulnerability was addressed in changeset 3713721 for the cf7-redirect-thank-you-page plugin slug.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session theft, credential capture, and administrative action hijacking.

Affected Products

Business Essentials for Contact Form 7 (plugin slug cf7-redirect-thank-you-page) — all versions through 1.2.1
WordPress sites with the plugin's Payments module enabled
Forms configured to accept both PayPal and Stripe gateways

Discovery Timeline

2026-10-01 - CVE-2026-97661 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-97661

Vulnerability Analysis

The vulnerability resides in the Payments module of the Business Essentials for Contact Form 7 plugin. User-controlled input submitted through the gateway form field is persisted and later rendered to the page without proper sanitization or output encoding. Because the payload is stored server-side, every subsequent request to the affected page re-serves the attacker-controlled script to visitors.

The affected code paths are referenced in the plugin's includes/modules/payments/cpt.php, includes/modules/payments/functions.php, and includes/modules/payments/redirect_methods.php files. These files handle the gateway selection value during form submission and render it back without applying WordPress escaping functions such as esc_attr() or esc_html(). The fix landed in changeset 3713721.

Root Cause

The root cause is a classic failure to sanitize input on write and escape output on render. The gateway form field accepts arbitrary string content from unauthenticated form submissions. The plugin treats this value as trusted when generating page markup associated with the payment redirect workflow, violating the WordPress developer guidance to escape late and escape often.

Attack Vector

An unauthenticated remote attacker submits a crafted payload through the gateway field of a vulnerable Contact Form 7 form on a site where both PayPal and Stripe gateways are enabled. The malicious value is stored and later reflected in rendered output. When an administrator or site visitor loads the affected page, the injected script executes in their browser context, inheriting their session cookies and privileges.

The vulnerability requires no privileges or user interaction to inject, though a victim must subsequently load the affected page for the script to fire. Successful exploitation can lead to administrative account takeover, backdoor plugin installation, and redirection of site visitors to attacker-controlled infrastructure.

// No verified exploit code is published for CVE-2026-97661.
// See the Wordfence advisory and plugin changeset for technical details.

Detection Methods for CVE-2026-97661

Indicators of Compromise

Unexpected <script> tags, event-handler attributes, or encoded JavaScript stored in Contact Form 7 payment-related post meta or custom post type entries created by cpt.php.
Outbound requests from administrator browsers to unfamiliar domains shortly after visiting pages that render form submission data.
New or modified WordPress administrator accounts, plugins, or theme files that correlate in time with form submissions containing suspicious gateway values.

Detection Strategies

Audit stored Contact Form 7 submission records and payment custom post type entries for HTML tags, JavaScript keywords (onerror, onload, javascript:), and URL-encoded payloads in the gateway field.
Review web server access logs for POST requests to Contact Form 7 endpoints containing script-like payloads in form parameters.
Deploy a web application firewall rule that flags HTML or JavaScript syntax in payment gateway selection parameters where only alphanumeric gateway identifiers are expected.

Monitoring Recommendations

Monitor WordPress wp_posts and wp_postmeta tables for payment-related entries containing HTML or script content.
Alert on changes to administrator accounts, user roles, and installed plugins following high-volume form submission activity.
Track Content Security Policy (CSP) violation reports from site visitors as a signal of injected inline scripts.

How to Mitigate CVE-2026-97661

Immediate Actions Required

Update the Business Essentials for Contact Form 7 plugin to the version released in changeset 3713721, which supersedes 1.2.1.
If updating is not immediately possible, disable the Payments module or reconfigure affected forms to use a single payment gateway rather than both PayPal and Stripe.
Review existing form submissions and payment custom post entries for injected payloads and purge any malicious content.
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found.

Patch Information

The vendor remediated the issue in the plugin update tracked by WordPress plugin changeset 3713721. Additional technical context is available in the Wordfence vulnerability report and the pre-patch source files for cpt.php, functions.php, and redirect_methods.php.

Workarounds

Disable the plugin's Payments module until the patched version is deployed.
Reconfigure vulnerable forms to accept only one of PayPal or Stripe, which removes the required precondition for exploitation.
Enforce a strict Content Security Policy that disallows inline scripts to limit the impact of stored XSS payloads.
Place the WordPress admin area behind an IP allowlist or additional authentication to reduce exposure of administrator sessions.

bash

# Temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate cf7-redirect-thank-you-page

# After confirming the patched release, update and reactivate
wp plugin update cf7-redirect-thank-you-page
wp plugin activate cf7-redirect-thank-you-page