CVE-2026-40807: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Aman CF7 Views – Complete Entry Management for Contact Form 7

This vulnerability (CVE-2026-40807) is an instance of CWE-79, improper neutralization of input during web page generation, leading to Cross-Site Scripting (XSS) in the Aman CF7 Views – Complete Entry Management for Contact Form 7 plugin. It affects all versions up to 3.2.6 and can be exploited by unauthenticated attackers. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in data disclosure, modification, or denial of service. Because the vulnerability is exploitable without authentication, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No vendor advisory or patch links are currently provided.