PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-83592 doctorwp CVE debrief

CVE-2026-83592 is a Stored Cross-Site Scripting vulnerability in Contact Form DB for Enfold plugin for WordPress, affecting versions up to 2.0.2. The vulnerability allows unauthenticated attackers to inject web scripts via contact form field values, which are echoed unescaped in admin pages. This vulnerability has a CVSS score of 7.2 and is considered HIGH severity. Defenders should assess exposure and prioritize remediation to prevent unauthenticated stored cross-site scripting. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious.

Vendor
doctorwp
Product
Contact Form DB for Enfold
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

Defenders responsible for WordPress installations using Contact Form DB for Enfold plugin version 2.0.2 or earlier should assess exposure and prioritize remediation to prevent unauthenticated stored cross-site scripting.

Why it matters

CVE-2026-83592 is a Stored Cross-Site Scripting vulnerability in Contact Form DB for Enfold plugin for WordPress, allowing unauthenticated attackers to inject web scripts via contact form field values. Defenders should prioritize verifying exposure and remediation to prevent potential attacks.

  • Unauthenticated attackers can inject web scripts via contact form field values
  • Injected scripts can execute on pages accessed by users
  • Defenders must verify exposure of affected WordPress installations
  • Remediation requires input sanitization and output escaping for contact form field values

Technical summary

The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability has a CVSS score of 7.2 and is considered HIGH severity. Defenders should prioritize verifying exposure of WordPress installations using Contact Form DB for Enfold plugin version 2.0.2 or earlier, and assess the risk of unauthenticated stored cross-site scripting. The payload is echoed unescaped both inside a title

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using Contact Form DB for Enfold plugin version 2.0.2 or earlier, and assess the risk of unauthenticated stored cross-site scripting.

Recommended defensive actions

  • Verify WordPress installations for Contact Form DB for Enfold plugin version 2.0.2 or earlier
  • Assess exposure to unauthenticated stored cross-site scripting
  • Implement input sanitization and output escaping for contact form field values
  • Monitor for suspicious activity on affected systems
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including affected versions and potential attack vectors. However, the corpus does not provide information on known exploitation or specific remediation steps.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-83592 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-83592

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-83592 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-83592

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.