Login Request a demo
Medium severity · published Oct 18, 2025
CVE-2025-9562
Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's qs_date shortcode in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Redirection for Contact Form 7 · themeisle
through 3.2.6 · source: vendor
Affected product
RF
Redirection for Contact Form 7
themeisle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9562
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9562
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.5/wpcf7r-functions.php#L558
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3378810%40wpcf7-redirect&new=3378810%40wpcf7-redirect&sfp_email=&sfph_mail=
wordpress.org
https://wordpress.org/plugins/wpcf7-redirect/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/5a801bb0-a7fc-42c3-b26f-3f7cdb592bea?source=cve
More from Redirection for Contact Form 7
8.8
CVE-2025-8141
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated Arbitrary File Deletion
8.8
CVE-2025-8145
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection
8.1
CVE-2025-14800
Redirection for Contact Form 7 <= 3.2.7 - Unauthenticated Arbitrary File Copy via move_file_to_upload
7.5
CVE-2025-8289
Redirection for Contact Form 7 <= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization
7.5
CVE-2023-39920
WordPress Redirection for Contact Form 7 plugin <= 2.9.2 - Broken Access Control vulnerability