CVE-2026-13425 describes a stored cross-site scripting vulnerability in the Database for CF7 plugin for WordPress, affecting all versions up to 1.2.6. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). Specifically, the plugin accepts array-structured input via the Contact Form 7 REST API endpoint and stores this data serialized in a custom database table without applying WordPress's standard save-time filtering mechanisms. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users viewing the injected pages.

An unauthenticated attacker can inject arbitrary web scripts that execute in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), indicating a significant risk due to network attack vector, no required privileges or user interaction, and impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected REST API endpoint or applying custom input sanitization and output escaping as a temporary mitigation.