CVE-2026-39745

bestweblayout Contact Form to DB by BestWebSoft

Published 6 Oct 2026 · updated 6 Oct 2026 · Deferred

7.1 High · CVSS 3.1, patchstack.com

Description

Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

References

patchstack.com/database/wordpress/plugin/contact-form-to-db/vulnerability/wordpress-contact-form-to-db-by-bestwebsoft-plugin-1-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve