Stored XSS in BestWebSoft Contact Form to DB Plugin

The 'Contact Form to DB by BestWebSoft - Messages Database Plugin' for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-13359. The vulnerability exists in all versions up to and including 1.7.5. It stems from insufficient input sanitization and output escaping on the 'cntctfrm_contact_dropdown' parameter.

An unauthenticated attacker can submit a crafted payload through the plugin's contact form. This payload is stored in the database and subsequently executed when an administrator views the submission within the plugin's message manager interface (/wp-admin/admin.php?page=cntctfrmtdb_manager). Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the administrator's session, potentially leading to unauthorized administrative actions, session hijacking, or site redirection.

Impact

Successful exploitation compromises the integrity and confidentiality of the WordPress administrative session. By executing scripts in the administrator's browser, an attacker could create new administrative accounts, modify site content, or perform other unauthorized actions. This vulnerability affects all WordPress instances using the specified plugin version.

Recommendation

• Update the 'Contact Form to DB by BestWebSoft' plugin to the latest version immediately.
• Until patched, disable the affected plugin if it is not business-critical.
• Implement a Web Application Firewall (WAF) to inspect and block incoming HTTP requests containing suspicious script tags or JavaScript event handlers in the 'cntctfrm_contact_dropdown' parameter.
• Monitor web server access logs for anomalous POST requests to the contact form endpoint that contain HTML/JavaScript syntax.