CVE-2023-5141

2023-12-0422:15:07

CWE-79

[email protected]

web.nvd.nist.gov

nvd

cve-2023-5141

wordpress

plugin

security

xss

bsk contact form

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

17.1%

JSON

The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected configurations

Vulners

NVD

Node

bannerskybsk_contact_form_7_blacklistRange≤1.0.1

VendorProductVersionCPE
bannerskybsk_contact_form_7_blacklist*cpe:2.3:a:bannersky:bsk_contact_form_7_blacklist:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bannersky	bsk_contact_form_7_blacklist	*	cpe:2.3:a:bannersky:bsk_contact_form_7_blacklist::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "BSK Contact Form 7 Blacklist",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "1.0.1"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]