CVE-2026-13425 is a stored cross-site scripting vulnerability in the Database for CF7 plugin for WordPress, affecting all versions up to 1.2.6. The vulnerability occurs because the plugin does not properly sanitize or escape array-structured input submitted through Contact Form 7's REST API endpoint (/wp-json/contact-form-7/v1/contact-forms/{id}/feedback). The plugin stores this data serialized in a custom table using $wpdb INSERT, bypassing WordPress's usual content filtering functions such as wp_insert_post and wp_kses. This allows unauthenticated attackers to inject malicious scripts that execute when users view the stored data, leading to potential compromise of user sessions or other client-side impacts.

An unauthenticated attacker can exploit this vulnerability to inject and store arbitrary JavaScript code in the plugin's database. When legitimate users access pages displaying the injected data, the malicious scripts execute in their browsers, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a CVSS 3.1 base score of 7.2 (high severity), with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Database for CF7 plugin or restricting access to the affected REST API endpoints to trusted users only. Monitoring for suspicious input and output sanitization at the application level may help reduce risk. Avoid using vulnerable versions and apply any vendor-provided updates promptly once released.