CVE-2021-25080 Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting

🗓️ 24 Jan 2022 08:01:28Reported by WPScanType

Contact Form Entries WordPress plugin unvalidated IP address leads to Cross-Site Scriptin

Reporter	Title	Published	Views	Family All 12
0day.today	WordPress CRM Form Entries 1.1.6 - Cross Site Scripting Vulnerability	3 Jan 202200:00	–	zdt
Circl	CVE-2021-25080	24 Jan 202212:17	–	circl
CNNVD	WordPress plugin 跨站脚本漏洞	3 Jan 202200:00	–	cnnvd
CNVD	WordPress CRM Form Entries Plugin Cross-Site Scripting Vulnerability	6 Jan 202200:00	–	cnvd
Check Point Advisories	Cross-Site Scripting Scanning Attempt (CVE-2015-4661; CVE-2019-16385; CVE-2019-9167; CVE-2020-10946; CVE-2020-12261; CVE-2020-13228; CVE-2020-13627; CVE-2020-13628; CVE-2020-14953; CVE-2021-21801; CVE-2021-25080; CVE-2022-25305; CVE-2022-28102)	22 Mar 201600:00	–	checkpoint_advisories
CVE	CVE-2021-25080	24 Jan 202208:01	–	cve
Exploit DB	WordPress Plugin Contact Form Entries 1.1.6 - Cross Site Scripting (XSS) (Unauthenticated)	5 Jan 202200:00	–	exploitdb
NVD	CVE-2021-25080	24 Jan 202208:15	–	nvd
Packet Storm	WordPress CRM Form Entries Cross Site Scripting	3 Jan 202200:00	–	packetstorm
Packet Storm	WordPress Contact Form Entries 1.1.6 Cross Site Scripting	5 Jan 202200:00	–	packetstorm

[
  {
    "product": "Contact Form Entries – Contact Form 7, WPforms and more",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.1.7",
        "status": "affected",
        "version": "1.1.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/acd3d98a-aab8-49be-b77e-e8c6ede171ac
plugins	www.plugins.trac.wordpress.org/changeset/2450335

24 Jan 2022 08:01Current

6.2Medium risk

Vulners AI Score6.2

EPSS0.84824

CWE-79