Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47926WordPress Contact Form to Email 1.3.24 Stored XSS

Medium 6.4

In plain English

A medium-severity cross-site scripting in Contact Form to Email from Form2Email. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 91.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Contact Form to Email 1.3.24 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating forms with script tags in the form name field. Attackers can craft form names containing JavaScript code that executes when other logged-in users access the form management page, enabling session hijacking or credential theft.

Affected products (as reported)

Vendor	Product	Versions
Form2Email	Contact Form to Email	1.3.24

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50524 exploit
Official Product Homepage product
VulnCheck Advisory: WordPress Contact Form to Email 1.3.24 Stored XSS third-party-advisory