CVE-2021-25080 Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting

2022-01-2408:01:28

CWE-79

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

31.8%

JSON

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

CNA Affected

[
  {
    "product": "Contact Form Entries – Contact Form 7, WPforms and more",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.1.7",
        "status": "affected",
        "version": "1.1.7",
        "versionType": "custom"
      }
    ]
  }
]