CVE-2026-111574: CWE-79 Cross-Site Scripting (XSS) in Redirection for Contact Form 7

The Redirection for Contact Form 7 WordPress plugin before version 3.2.12 contains a stored Cross-Site Scripting (CWE-79) vulnerability. Specifically, submitted form data saved as lead entries is not properly sanitized or escaped before being output in the lead debug metabox. An unauthenticated attacker can exploit this by submitting malicious scripts which will execute in the context of any logged-in user who views the lead debug metabox with debug mode enabled. This vulnerability affects versions from 2.2.7 up to but not including 3.2.12.

An attacker can store malicious scripts via form submissions that execute in the browser of logged-in users who access the lead debug metabox with debug mode enabled. This could lead to session hijacking, privilege escalation, or other actions performed with the victim's privileges within the WordPress admin interface. However, exploitation requires the victim to be logged in and to have debug mode enabled, limiting the exposure.

Upgrade the Redirection for Contact Form 7 plugin to version 3.2.12 or later where this issue is fixed. Until then, avoid enabling debug mode in production environments or restrict access to the lead debug metabox to trusted users only. There is no vendor advisory or patch link provided, but the fixed version is explicitly stated.