Input validation

2023-06-0702:15:00

PRIOn knowledge base

www.prio-n.com

wordpress

html injection

input sanitization

output escaping

unauthenticated attackers

phishing

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-pirateforms-public.php’ file in versions up to, and including, 2.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML in emails that could be used to phish unsuspecting victims.

CPENameOperatorVersion
contact_formle2.5.1

CPE	Name	Operator	Version
	contact_form	le	2.5.1

References

blog.nintechnet.com/html-injection-vulnerability-in-wordpress-pirate-forms-plugin/

www.wordfence.com/threat-intel/vulnerabilities/id/9e34c3f6-cc84-4e45-9948-6f7fd5cba8cd?source=cve