CVE-2026-23970 Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.

Affected products and versions

Product	Affected versions	Fixed in
Redirection for Contact Form 7 3.2	earliest → 3.2.8	No fix stated

Other CVEs of Redirection for Contact Form 7

The 9 CVEs of Redirection for Contact Form 7 →

CVE-2026-120659 Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter 5.3 Medium CVE-2025-14800 The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type… 8.1 High CVE-2025-9562 The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… 6.4 Medium CVE-2025-8141 The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient… 8.8 High