CVE-2021-25080

🗓️ 24 Jan 2022 08:01:28Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 62 Views🌐 WEB

The Contact Form Entries WordPress plugin before 1.1.7 allows XSS attack

Reporter	Title	Published	Views	Family All 12
0day.today	WordPress CRM Form Entries 1.1.6 - Cross Site Scripting Vulnerability	3 Jan 202200:00	–	zdt
Circl	CVE-2021-25080	24 Jan 202212:17	–	circl
CNNVD	WordPress plugin 跨站脚本漏洞	3 Jan 202200:00	–	cnnvd
CNVD	WordPress CRM Form Entries Plugin Cross-Site Scripting Vulnerability	6 Jan 202200:00	–	cnvd
Check Point Advisories	Cross-Site Scripting Scanning Attempt (CVE-2015-4661; CVE-2019-16385; CVE-2019-9167; CVE-2020-10946; CVE-2020-12261; CVE-2020-13228; CVE-2020-13627; CVE-2020-13628; CVE-2020-14953; CVE-2021-21801; CVE-2021-25080; CVE-2022-25305; CVE-2022-28102)	22 Mar 201600:00	–	checkpoint_advisories
Cvelist	CVE-2021-25080 Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting	24 Jan 202208:01	–	cvelist
Exploit DB	WordPress Plugin Contact Form Entries 1.1.6 - Cross Site Scripting (XSS) (Unauthenticated)	5 Jan 202200:00	–	exploitdb
NVD	CVE-2021-25080	24 Jan 202208:15	–	nvd
Packet Storm	WordPress CRM Form Entries Cross Site Scripting	3 Jan 202200:00	–	packetstorm
Packet Storm	WordPress Contact Form Entries 1.1.6 Cross Site Scripting	5 Jan 202200:00	–	packetstorm

NVD

Vulners

Node

crmperks contact_form_entriesRange<1.1.7wordpress

[
  {
    "product": "Contact Form Entries – Contact Form 7, WPforms and more",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.1.7",
        "status": "affected",
        "version": "1.1.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/acd3d98a-aab8-49be-b77e-e8c6ede171ac
plugins	www.plugins.trac.wordpress.org/changeset/2450335

Parameter	Position	Path	Description	CWE
HTTP_CLIENT_IP	header	/index.php?rest_route=/contact-form-7/v1/contact-forms/10/feedback	Stored XSS via unvalidated client IP headers in POST to contact-form-entries vulnerable endpoint	CWE-79
Client-IP	header	/index.php?rest_route=/contact-form-7/v1/contact-forms/10/feedback	Stored XSS via unvalidated client IP headers in POST to contact-form-entries vulnerable endpoint	CWE-79

17 Jun 2026 03:41Current

6Medium risk

Vulners AI Score6

CVSS 24.3

CVSS 3.16.1

EPSS0.84824

CWE-79