EIP-2026-113648

This is a functional proof-of-concept for a CSRF and stored XSS vulnerability in the Contact Form Manager WordPress plugin. The PoC demonstrates how an attacker can submit a crafted form to inject malicious JavaScript payloads into SMTP settings and contact form names.