CVE-2026-112379 in Contact Form Email Plugin
Summary
by MITRE • 10/23/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this flaw manifests as a Stored XSS within the Codepeople Contact Form Email plugin for WordPress. Unlike reflected XSS attacks where malicious scripts are embedded in URLs and executed immediately upon user interaction with that specific link, stored vulnerabilities persist on the target server. In this context, the attacker injects malicious JavaScript code into fields or inputs managed by the contact form system. Because the vulnerability is located within a component responsible for handling email communications from web forms, the injected payload is likely saved to the database and subsequently rendered in administrative interfaces or notification emails viewed by site administrators or other privileged users. This persistence mechanism significantly increases the severity of the issue compared to transient reflection attacks, as the malicious code remains active until the vulnerable data is manually removed or the plugin is updated.
The technical root cause lies in insufficient input validation and output encoding mechanisms within versions 1.3.68 and earlier of the Contact Form Email plugin. When user-supplied data from contact form submissions is processed, the application fails to properly sanitize special characters such as angle brackets, quotes, or ampersands before storing them for later retrieval. Consequently, when this untrusted input is rendered in a web page context without appropriate encoding, the browser interprets the injected script tags as executable code rather than plain text. This failure adheres closely to CWE-79, which defines Improper Neutralization of Script-Related HTML Tags in a Web Page. The lack of robust sanitization allows an attacker to bypass standard security controls that rely on basic character filtering, enabling the execution of arbitrary JavaScript within the context of the vulnerable website's domain.
The operational impact of this vulnerability is substantial due to its stored nature and the typical privileges associated with viewing contact form submissions or email logs. An authenticated attacker, potentially a low-privilege user such as a subscriber or contributor who can access the front-end forms, can inject payloads that execute when an administrator views the submission history or receives the automated email notification containing the malicious content. This scenario facilitates session hijacking, where the attacker steals administrative cookies to gain full control over the WordPress installation. It also enables keylogging, credential harvesting from login pages visited by administrators while their browser is compromised, and defacement of the site interface. Furthermore, because the payload is stored, it affects every user who views the infected content, potentially leading to widespread compromise if multiple administrators or users access the affected areas.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution in a browser context. The attack vector leverages social engineering elements inherent in web forms, where victims are prompted to submit data that appears legitimate but contains hidden malicious payloads. This falls under the broader category of Initial Access or Execution depending on whether the stored script is used solely for information gathering or active exploitation. The persistence aspect means that even after the initial injection, the threat remains dormant until triggered by a privileged user interaction, making detection and remediation critical to prevent long-term compromise.
Mitigation strategies must prioritize immediate patching of the affected plugin versions. Administrators should upgrade Codepeople Contact Form Email to version 1.3.69 or later, where input sanitization and output encoding have been corrected to neutralize script injection attempts. In environments where upgrading is not immediately feasible, temporary mitigations include implementing a Web Application Firewall (WAF) with rules specifically tuned to detect and block XSS payloads in form submission fields. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any successful execution by restricting the sources from which scripts are allowed to load. Regular security audits and code reviews focusing on data handling practices within plugins that process user input are essential to prevent similar vulnerabilities arising from improper neutralization of web page content in future updates or other software components.