This vulnerability (CVE-2026-23970) is an instance of CWE-79, improper neutralization of input during web page generation, leading to cross-site scripting (XSS) in the Themeisle Redirection for Contact Form 7 plugin. It affects all versions up to and including 3.2.8. The flaw allows unauthenticated attackers to inject malicious scripts, which can execute in the context of the victim's browser, potentially leading to data theft, session hijacking, or other impacts. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. As of the published date, no patch or official remediation is documented.

Successful exploitation can lead to execution of arbitrary scripts in the context of users visiting affected web pages, resulting in partial loss of confidentiality, integrity, and availability of the affected system or user data. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to websites using the affected plugin versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin versions (<=3.2.8) to mitigate risk. Avoid exposing vulnerable functionality to untrusted users and monitor for updates from Themeisle regarding patches or workarounds.