The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.
{"wpexploit": [{"lastseen": "2023-07-24T02:41:29", "description": "The plugin does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-16T00:00:00", "type": "wpexploit", "title": "Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-2718"], "modified": "2023-05-16T06:26:05", "id": "WPEX-ID:8AD824A6-2D49-4F02-8252-393C59AA9705", "href": "", "sourceData": "1. Publish the default form to a page by clicking on \"Contact Form to Email\" in the sidebar, and the \"Publish\" button beside the form name.\r\n2. Visit the form on the frontend. Fill in the Email and Subject with arbitrary, valid values. Fill in the Message field with `</textarea><img src=x onerror=alert(/XSS/)>`\r\n3. Submit the form.\r\n4. In the backend, on the \"Contact Form to Email\" page, click on \"Messages\" and click the \"Edit\" button corresponding to the new message.\r\n5. See the XSS has been triggered.", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}], "prion": [{"lastseen": "2023-08-15T14:14:39", "description": "The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-06-12T18:15:00", "type": "prion", "title": "CVE-2023-2718", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-2718"], "modified": "2023-06-16T18:42:00", "id": "PRION:CVE-2023-2718", "href": "https://kb.prio-n.com/vulnerability/CVE-2023-2718", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}], "wpvulndb": [{"lastseen": "2023-07-24T02:41:29", "description": "The plugin does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.\n\n### PoC\n\n1\\. Publish the default form to a page by clicking on \"Contact Form to Email\" in the sidebar, and the \"Publish\" button beside the form name. 2\\. Visit the form on the frontend. Fill in the Email and Subject with arbitrary, valid values. Fill in the Message field with `` 3\\. Submit the form. 4\\. In the backend, on the \"Contact Form to Email\" page, click on \"Messages\" and click the \"Edit\" button corresponding to the new message. 5\\. See the XSS has been triggered.\n", "cvss3": {"exploitabilityScore": 2.3, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2023-05-16T00:00:00", "type": "wpvulndb", "title": "Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 6.8, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 4.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2023-2718"], "modified": "2023-05-16T06:26:05", "id": "WPVDB-ID:8AD824A6-2D49-4F02-8252-393C59AA9705", "href": "https://wpscan.com/vulnerability/8ad824a6-2d49-4f02-8252-393c59aa9705", "sourceData": "", "cvss": {"score": 4.9, "vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N"}}]}
CVE-2023-2718
