CVE-2026-39745: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in bestweblayout Contact Form to DB by BestWebSoft

This vulnerability (CVE-2026-39745) is an unauthenticated Cross-Site Scripting (XSS) flaw in the Contact Form to DB plugin by BestWebSoft, versions up to and including 1.7.6. The issue arises from improper neutralization of input during web page generation (CWE-79), allowing attackers to inject malicious scripts. The CVSS 3.1 score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability.

Successful exploitation can allow attackers to execute arbitrary scripts in the context of the affected web application without authentication. This can lead to partial compromise of user data confidentiality, data integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor the vendor's communications for updates and consider applying any available updates promptly once released.