{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/business-essentials-for-contact-form-7--1.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:business_essentials_for_contact_form_7_project:business_essentials_for_contact_form_7:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-97661"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Business Essentials for Contact Form 7 (\u003c= 1.2.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","wordpress"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Business Essentials for Contact Form 7 plugin for WordPress (versions 1.2.1 and earlier) contains a critical security vulnerability identified as CVE-2026-97661. This vulnerability is a Stored Cross-Site Scripting (XSS) flaw located within the gateway form field. The vulnerability arises from insufficient input sanitization and output escaping when processing user-supplied data. Exploitation is possible when the plugin's Payments module is active and configured to support both PayPal and Stripe payment gateways. Unauthenticated attackers can exploit this by injecting malicious scripts into the form fields, which are subsequently stored and executed in the browsers of users viewing the affected pages. This flaw can lead to session hijacking, unauthorized actions, or redirection to malicious sites.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator or user session. This could result in the theft of authentication cookies, administrative credential harvesting, or further compromise of the WordPress environment. This vulnerability affects all installations using the specified plugin version range.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of the Business Essentials for Contact Form 7 plugin within the environment and confirm the version is 1.2.1 or below.\u003c/li\u003e\n\u003cli\u003eDisable the Payments module in the plugin settings as a temporary mitigation until an update is applied.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and mitigate the impact of potential XSS attacks.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for suspicious POST requests to forms utilizing the gateway parameter that contain HTML tags or JavaScript event handlers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-01T10:40:37Z","date_published":"2026-10-01T10:40:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-97661/","summary":"The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the gateway field.","title":"Stored XSS in Business Essentials for Contact Form 7","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-97661/"}],"language":"en","title":"CraftedSignal Threat Feed - Business Essentials for Contact Form 7 (\u003c= 1.2.1)","version":"https://jsonfeed.org/version/1.1"}