CVE-2021-24276 Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

2021-05-0518:28:48

CWE-79

WPScan

www.cve.org

cve-2021-24276

contact form

supsystic

xss

wordpress_plugin

options_page

attribute_sanitization

EPSS

0.002

Percentile

64.8%

JSON

The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

CNA Affected

[
  {
    "product": "Contact Form by Supsystic",
    "vendor": "Supsystic",
    "versions": [
      {
        "lessThan": "1.7.15",
        "status": "affected",
        "version": "1.7.15",
        "versionType": "custom"
      }
    ]
  }
]