Skip to content
Sign in
4.7 Medium

CVE-2026-14236 The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it…

Description

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.

Affected products and versions

Product Affected versions Fixed in
Contact Form 7 2.5 earliest → < 2.5 2.5

Other CVEs of Contact Form 7

The 2 CVEs of Contact Form 7 →
CVE-2024-4704 The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and… 6.1 Medium
Track this CVE