Slim Jetpack: Stored Cross-Site Scripting via contact form (CVE-2026-115498)

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping. The vulnerability resides in the 'g<PAGE_ID>-website' parameter. Unauthenticated attackers can exploit this via the [contact-form] shortcode because nonce and authentication checks are only enforced for authenticated users, allowing guest submissions of malicious payloads.

Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the browser of any user who accesses the page where the payload is stored.

Recommendation

• Update the Slim Jetpack plugin to a version beyond 2.7.0.1 immediately.
• Implement a Web Application Firewall (WAF) rule to inspect POST requests to the [contact-form] shortcode endpoints for script tags or common XSS patterns in the website URL/contact fields.
• Review WordPress access logs for anomalous POST requests containing HTML or script tags directed at pages utilizing the Slim Jetpack [contact-form].