CVE-2026-85117
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 09, 2026
Vendor
unknown
Description
The Contact Form 7 Captcha WordPress plugin before 0.1.9 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.