Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

Magic Tooltips for Contact Form 7 runs attacker scripts

CVE-2026-101928 · published 1 month ago
Summary

The Magic Tooltips for Contact Form 7 plugin lets anyone submit a comment with a specially crafted name that is later shown as HTML on the admin’s comment‑management page. When an administrator opens that page, the hidden code runs in their browser, potentially stealing information or changing settings. Update the plugin to the latest version or disable it until a safe release is available.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
magicplugins magic tooltips for contact form 7 <= 1.0.34
Original advisory text
Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g. those containing '&lt;tip&gt;') back into live HTML, meaning an entity-encoded script payload submitted as a comment author name — which bypasses sanitize_text_field — is rendered as executable markup when an administrator views wp-admin/edit-comments.php.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published3 Oct 2026
Updated4 Nov 2026
First seen3 Oct 2026
Sources
CVE-2026-101928 · NVD
CVE-2026-101928 · MITRE
Track software like this
Free during beta