EIP-2026-113645

This exploit demonstrates an unauthenticated stored XSS vulnerability in WordPress Plugin Contact Form Entries versions prior to 1.1.7. The attack involves injecting malicious JavaScript via the HTTP_CLIENT_IP header, which is stored in the database and executed when an administrator views the entry.