CVE-2026-101928 in Magic Tooltips for Contact Form 7 Plugin
Summary
by MITRE • 10/03/2026
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g. those containing '<tip>') back into live HTML, meaning an entity-encoded script payload submitted as a comment author name — which bypasses sanitize_text_field — is rendered as executable markup when an administrator views wp-admin/edit-comments.php.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The Magic Tooltips For Contact Form 7 plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.0.34, classified under the Common Weakness Enumeration identifier CWE-80 as Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). This flaw stems from insufficient input sanitization and output escaping mechanisms within the plugin's handling of user-supplied data. Specifically, the vulnerability resides in the processing of the author parameter associated with comment submissions. The core technical failure occurs because the plugin utilizes an esc_html filter callback that inadvertently decodes HTML-entity-encoded payloads back into their live HTML equivalents. This behavior effectively neutralizes a common defense mechanism where attackers might attempt to obfuscate malicious scripts using entity encoding, such as converting less-than and greater-than symbols into < and >, which would typically be rendered harmless by standard sanitization functions like sanitize_text_field.
The operational impact of this vulnerability is significant due to its classification as a Stored Cross-Site Scripting (XSS) attack vector. Unlike reflected XSS, where the malicious script is contained within a single HTTP request, stored XSS persists on the target server because the injected payload is saved in the database and subsequently served to other users. In this specific scenario, an unauthenticated attacker can inject arbitrary web scripts by submitting them as part of a comment author name. When an administrator or any user with sufficient privileges views the comments section at wp-admin/edit-comments.php, the browser interprets the decoded HTML entities as executable code. This execution occurs within the context of the administrative interface, allowing the malicious script to run with elevated privileges relative to standard site visitors.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007, which covers Command and Scripting Interpreter via JavaScript in web applications. The ability for an unauthenticated actor to execute arbitrary scripts on behalf of administrators poses severe risks beyond simple defacement or session hijacking. Attackers can leverage this access to steal administrative cookies, perform actions on behalf of the administrator such as modifying site settings or installing malicious plugins, and potentially pivot further into the internal network if the WordPress installation has broader system implications. The persistence of the payload ensures that every time an admin accesses the comments page, they are exposed to the attack without needing a specific trigger link, increasing the likelihood of successful exploitation through routine administrative tasks.
Mitigation strategies for this vulnerability involve immediate remediation at both the application and infrastructure levels. Administrators should update the Magic Tooltips For Contact Form 7 plugin to version 1.0.35 or later, where the developers have presumably corrected the esc_html filter callback logic to ensure that HTML entities are not decoded back into executable markup during output rendering. In cases where immediate patching is not feasible due to compatibility constraints, temporary mitigations include implementing a Web Application Firewall (WAF) rule set designed to detect and block XSS payloads containing encoded script tags in comment author fields. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of the injected code even if it bypasses input validation controls.