CVE-2026-121768 is a stored cross-site scripting (XSS) vulnerability in the Contact Form 7 – Post Fields plugin by Markus Wiesenhofer. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability affects versions from initial releases up to 2.7.0. A fix is available in version 2.7.1.