WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms <= 1.8.5 - Reflected Cross-Site Scripting via Pricing Page Query Parameters
- ID
- WPSEC-2026-3007
- Plugin
- WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms (cf7-styler)
- Affected
- all versions before 1.9.0
- Remediation
- Update to 1.9.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms on WPSec AttackSurface
- Fix released
- Published
Description
The WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via query-string parameters on the pricing admin page of the bundled Freemius SDK in all versions up to, and including, 1.8.5. This is due to $_GET values being merged after the trusted configuration values passed to the Freemius pricing JavaScript app, so request parameters such as contact_url, fs_wp_endpoint_url and request_handler_url override them without validation. The contact_url value is rendered as the href of the pricing page's contact links. This makes it possible for unauthenticated attackers to inject arbitrary web scripts (for example through a javascript: URL) or to point the pricing app's requests and redirects at attacker-controlled URLs. The attacker must trick a logged-in administrator into opening a crafted link and interacting with the page.
References
- https://wpsec.com/vuln/WPSEC-2026-3007/
- https://plugins.svn.wordpress.org/cf7-styler/tags/1.9.0/
- https://wordpress.org/plugins/cf7-styler/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS