CVE-2026-97661

{
  "etk_id": "ETK-2026-415",
  "cve_id": "CVE-2026-97661",
  "display_id": "CVE-2026-97661",
  "ghsa_id": "GHSA-h887-w8fc-499x",
  "euvd_id": "EUVD-2026-90574",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Business Essentials for Contact Form 7",
  "summary": "Business Essentials for Contact Form 7 versions through 1.2.1 contain a stored cross-site scripting flaw in the gateway form field. An unauthenticated attacker may cause script to run in a visitor's browser when they view an affected page, if the Payments module is enabled and a form accepts both PayPal and Stripe.",
  "mitigation": "Disable the Payments module or reconfigure forms so they do not accept both PayPal and Stripe until an updated release is available. No fixed version is recorded in the advisory.",
  "vendor": "scottpaterson",
  "product": "Business Essentials for Contact Form 7",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Business Essentials for Contact Form 7",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0024,
  "epss_percentile": 0.1372,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 52.200337133333335,
  "t0_at": "2026-10-01T08:28:45.774000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T08:28:45.774000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T08:28:45.774000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97661"
    }
  }
}