CVE-2026-39449 HIGH

CVE-2026-39449: WordPress Contact Form to Any API plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Vendor It Path Solutions

Product Contact Form to Any API

Weakness CWE-79 · XSS

Published June 15, 2026

Last update June 15, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Contact Form to Any API versions 3.0.3 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a victim's browser when they visit an affected page. The vulnerability requires user interaction and can affect other users or the site itself depending on where the injection occurs.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts that run in visitors' browsers to steal data, redirect users, or deface content.

Potential impact on your site

04Site Impact

Visitors' sessions, credentials, or personal data could be compromised; site reputation and trust may be damaged.

Conditions required to exploit

05Prerequisites

Victim must visit a page containing the attacker's malicious input; no authentication required.

Key dates

06Disclosure timeline

June 15, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-39449 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

Identifiers

CVE CVE-2026-39449

CWE CWE-79

CVSS 7.1 / HIGH

Affected versions