CVE-2026-32517
Published: 25 March 2026
Summary
CVE-2026-32517 is a high-severity Cross-site Scripting (CWE-79) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 11.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-15 directly addresses reflected XSS by requiring filtering of information outputs to neutralize malicious scripts before they execute in victims' browsers.
SI-10 enforces validation of user inputs to reject or sanitize malicious payloads that could be reflected as XSS in web page generation.
SI-2 mandates timely remediation of identified flaws like this CVE in the Contact Manager plugin, preventing exploitation through patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS enables script injection via crafted malicious links sent to victims (T1566.002) with resulting arbitrary JavaScript execution in the browser (T1059.007).
NVD Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kleor Contact Manager contact-manager allows Reflected XSS.This issue affects Contact Manager: from n/a through <= 9.1.
Deeper analysisAI
CVE-2026-32517 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Kleor Contact Manager contact-manager WordPress plugin. This issue affects all versions from an unspecified initial release through 9.1, as published on 2026-03-25.
The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), indicating it is exploitable remotely over the network with low attack complexity and no authentication privileges required, though it demands user interaction. Attackers can craft malicious inputs that, when reflected in web page generation, execute arbitrary scripts in the browser of a victim who interacts with the payload, such as by visiting a malicious link, achieving low impacts on confidentiality, integrity, and availability within a changed scope.
The primary advisory from Patchstack documents this Reflected XSS vulnerability in the WordPress Contact Manager plugin up to version 9.1, available at https://patchstack.com/database/Wordpress/Plugin/contact-manager/vulnerability/wordpress-contact-manager-plugin-9-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)