CVE-2026-97661 in Business Essentials for Contact Form 7 Plugin
Summary
by MITRE • 10/01/2026
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Payments module to be enabled and a form to be configured to accept both PayPal and Stripe as payment gateways.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The Business Essentials for Contact Form 7 plugin, specifically within versions up to and including 1.2.1, contains a critical security flaw classified as Stored Cross-Site Scripting (XSS). This vulnerability stems from insufficient input sanitization and output escaping mechanisms when handling the gateway form field. The core technical issue lies in the application's failure to properly validate or encode user-supplied data before storing it in the database and subsequently rendering it on web pages without appropriate encoding. Consequently, any malicious script injected into this specific field is preserved within the system's persistent storage rather than being neutralized during input processing.
The operational impact of this vulnerability allows unauthenticated attackers to inject arbitrary JavaScript code that will execute automatically whenever a user accesses a page containing the compromised form data. Because the payload is stored server-side, it does not require complex social engineering or direct interaction with the attacker's infrastructure for each execution; instead, the malicious script becomes part of the legitimate content served to victims. This persistence significantly increases the potential blast radius and severity of the attack compared to reflected XSS variants, as every visitor viewing the affected page may trigger the exploit without any additional action on their part other than loading the webpage.
Successful exploitation is contingent upon specific configuration states within the WordPress environment. The attacker must have access to a form that has been configured to accept both PayPal and Stripe payment gateways, with the Payments module enabled in the plugin settings. This requirement suggests that the vulnerability is tied specifically to how these third-party integration fields are processed during submission or display. If the underlying code does not distinguish between legitimate gateway identifiers and malicious script payloads when rendering them back to the user interface, it creates a direct path for client-side code execution within the context of the victim's session with the WordPress site.
From an industry standards perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored data being rendered without proper encoding, fitting the profile of persistent XSS attacks. In terms of tactical classification under the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1059, Command and Control via Application Layer Protocol or more specifically T1189 Drive-by Client-side Script Injection when considering the delivery method through compromised web content. The attack vector leverages trusted websites to deliver malicious payloads, exploiting the trust users place in the domain they are visiting.
To mitigate this risk, immediate action is required for all administrators running affected versions of the Business Essentials plugin. Updating the plugin to a version later than 1.2.1 where these sanitization and escaping issues have been resolved by the developers is the primary remediation step. Until an update can be applied or if no patch exists, administrators should consider disabling the Payments module entirely or removing forms that utilize both PayPal and Stripe gateways simultaneously to eliminate the attack surface. Additionally implementing a Web Application Firewall with robust XSS detection rules may help block malicious payloads before they are stored in the database, although this is only a compensatory control and not a substitute for fixing the underlying code deficiency. Regular security audits of custom WordPress plugins and strict adherence to input validation best practices are essential to prevent similar vulnerabilities in future deployments.