CVE-2026-65438 Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.

Affected products and versions

Product	Affected versions	Fixed in
Message Filter for Contact Form 7 1.6	earliest → 1.6.3.9	No fix stated

Other CVEs of Message Filter for Contact Form 7

The 5 CVEs of Message Filter for Contact Form 7 →

CVE-2026-57423 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome… 7.1 High CVE-2025-46252 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome… 7.6 High CVE-2024-54254 Missing Authorization vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter.This issue… 6.3 Medium CVE-2024-39647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome… 7.1 High