PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-112379 Codepeople CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-22T07:01:09.851Z and has not been modified since then. The WordPress Contact Form Email plugin versions up to 1.3.68 are vulnerable to Cross Site Scripting (XSS). This issue allows for Stored XSS and has a CVSS score of 7.1. Defenders should prioritize verifying exposure of WordPress Contact Form Email plugin versions up to 1.3.68 and assess the need for updates or compensating controls. The vulnerability affects WordPress installations with the Contact Form Email plugin. Verification of exposure and potential updates are crucial.

Vendor
Codepeople
Product
Contact Form Email
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-22
Original CVE updated
2026-10-22
Advisory published
2026-10-22
Advisory updated
2026-10-22

Who should care

Defenders responsible for WordPress installations with the Contact Form Email plugin should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-112379 is a Cross Site Scripting (XSS) vulnerability in WordPress Contact Form Email plugin versions up to 1.3.68, allowing for Stored XSS attacks. Defenders should prioritize verifying exposure and assessing the need for updates or compensating controls.

  • Verification of exposure for WordPress Contact Form Email plugin versions up to 1.3.68
  • Potential for Stored XSS attacks
  • Need for updates or compensating controls

Technical summary

The WordPress Contact Form Email plugin versions up to 1.3.68 are vulnerable to Cross Site Scripting (XSS). This issue allows for Stored XSS and has a CVSS score of 7.1. The vulnerability enables attackers to inject malicious scripts into the contact form, potentially leading to unauthorized actions or data breaches. Defenders should prioritize verifying exposure and assessing the need for updates or compensating controls. The vulnerability is confirmed, and specific details on exploitation and impact require verification from official sources.

Defensive priority

Defenders should prioritize verifying exposure of WordPress Contact Form Email plugin versions up to 1.3.68 and assess the need for updates or compensating controls.

Recommended defensive actions

  • Verify exposure of WordPress Contact Form Email plugin versions up to 1.3.68
  • Assess the need for updates or compensating controls
  • Monitor for potential XSS attacks

Evidence notes

The CVE record and source item provide details on the Cross Site Scripting (XSS) vulnerability in WordPress Contact Form Email plugin versions up to 1.3.68. However, specific details on exploitation, impact, and remediation require verification from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-112379 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-112379

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-112379 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-112379

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.