WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute vulnerability

🗓️ 02 Jul 2024 01:58:49Reported by wesley (wcraft)Type

Authenticated users can exploit stored XSS in Void Contact Form Seven widget for Elementor Page Builder versions 2.4 and below via cf7_redirect_page.

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin Void Contact Form 7 security vulnerability	2 Jul 202400:00	–	cnnvd
CVE	CVE-2024-5419	2 Jul 202403:14	–	cve
Cvelist	CVE-2024-5419 Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute	2 Jul 202403:14	–	cvelist
EUVD	EUVD-2024-46641	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5419	2 Jul 202404:15	–	nvd
OSV	CVE-2024-5419	2 Jul 202404:15	–	osv
Patchstack	WordPress Void Contact Form 7 Widget For Elementor Page Builder Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS)	2 Jul 202400:00	–	patchstack
RedhatCVE	CVE-2024-5419	23 May 202508:30	–	redhatcve
Vulnrichment	CVE-2024-5419 Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute	2 Jul 202403:14	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (July 1, 2024 to July 7, 2024)	11 Jul 202415:09	–	wordfence

Vulners

Node

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cf7-widget-elementor/void-contact-form-7-widget-for-elementor-page-builder-24-authenticated-contributor-stored-cross-site-scripting-via-cf7-redirect-page-attribute

02 Jul 2024 01:58Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.4 - 6.4

EPSS0.00391

SSVC