CVE-2026-13359

CVE-2026-13359 is a stored cross-site scripting (XSS) vulnerability in the Contact Form to DB by BestWebSoft - Messages Database plugin for WordPress, caused by insufficient input sanitization and output escaping of the cntctfrm_contact_dropdown parameter. An unauthenticated attacker can submit a crafted contact form entry containing arbitrary web script, which is stored and later executes whenever an administrator opens the plugin's message manager page at /wp-admin/admin.php?page=cntctfrmtdb_manager. Because the payload runs in the administrator's authenticated browser session, the attacker can perform admin-level actions such as creating rogue administrator accounts or planting additional malicious content. Any WordPress site running the plugin at version 1.7.5 or earlier with a publicly reachable contact form is affected, and no authentication is required to plant the payload. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS estimates only a ~0.2% probability of exploitation in the next 30 days.

What to do: Update the plugin to the first release after 1.7.5 as soon as a patched version is published, or temporarily deactivate it on sites where it is not required. Until patched, review stored contact-form messages for unexpected HTML or script content in the cntctfrm_contact_dropdown field and restrict administrator access to the message manager page. Because payload injection requires no authentication on sites with public contact forms, sites running 1.7.5 or older should treat this as a priority update despite the currently low exploitation indicators.