Medium · 6.1 CVE-2021-36885 EUVD-2021-23461GHSA-f57v-3pv4-pqw9

WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Published Dec 22, 2021 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: CipherCoin Product: Contact Form 7 Database Addon – CFDB7 (WordPress plugin) Category: Web / CMS

Description

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).

Affected products

Vendor	Product	Affected	Fixed
CipherCoin	Contact Form 7 Database Addon – CFDB7 (WordPress plugin)	<= 1.2.6.1 – ≤ 1.2.6.1	—

References

https://wordpress.org/plugins/contact-form-cfdb7/#developers
https://patchstack.com/database/vulnerability/contact-form-cfdb7/wordpress-contact-form-7-database-addon-cfdb7-plugin-1-2-6-1-unauthenticated-stored-cross-site-scripting-xss-vulnerability