CVE-2026-83592: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in doctorwp Contact Form DB for Enfold

CVE-2026-83592 is a stored cross-site scripting vulnerability in the Contact Form DB for Enfold plugin for WordPress, affecting all versions up to 2.0.2. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). Specifically, contact form field values are insufficiently sanitized and escaped, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts are reflected unescaped both inside a title HTML attribute and within table cell bodies on the admin/ecf_index.php page. Attempts to neutralize the payload via base64 encoding and serialization are ineffective, enabling persistent XSS attacks.

An attacker can inject and execute arbitrary scripts in the context of the affected admin page without authentication. This can lead to partial confidentiality and integrity loss (CVSS impact: low confidentiality and integrity impact, no availability impact). The vulnerability could be exploited to perform actions such as session hijacking or unauthorized actions within the admin interface if an administrator views the injected content.

No official patch or fix is currently referenced. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected admin pages to trusted users only and consider disabling or removing the vulnerable plugin. Avoid opening or interacting with untrusted contact form submissions that may contain malicious payloads.