Cross site scripting

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2022-2187 Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting

The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...

CVE-2022-2187

The CVE-2022-2187 issue affects the WordPress Contact Form 7 Captcha plugin (versions before 0.1.2). Root cause: the plugin does not escape the $_SERVER['REQUEST_URI'] value before outputting it in an attribute, allowing reflected XSS in some browsers. Impact: reflected XSS could enable script in...

WordPress plugin Contact Form 7 Captcha 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRF

The plugin lets user input reach a sensitive requireonce call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server. PoC 1 Create a malicious PHP script $ echo ' shell.php 2 Add it to a fake .doc file, who...

WordPress CAPTCHA 4WP plugin <= 7.0.6.1 - Local File Inclusion (LFI) via Cross-Site Request Forgery (CSRF) vulnerability

Local File Inclusion LFI via Cross-Site Request Forgery CSRF vulnerability was discovered by ZhongFu Su JrXnm in the WordPress CAPTCHA 4WP plugin versions = 7.0.6.1. Solution Update the WordPress CAPTCHA 4WP plugin to the latest available version at least 7.1.0...

CAPTCHA 4WP < 7.1.0 - Local File Inclusion via CSRF

The plugin lets user input reach a sensitive requireonce call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server. 1 Create a malicious PHP script $ echo ' shell.php 2 Add it to a fake .doc file, who will...

Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting

The plugin does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers PoC https://example.com/wp-admin/options-general.php?page=cf7sredit&"...

WordPress Contact Form 7 Captcha plugin <= 0.1.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by ZhongFu Su aka JrXnm WuHan University in WordPress Contact Form 7 Captcha plugin versions = 0.1.1. Solution Update the WordPress Contact Form 7 Captcha plugin to the latest available version at least 0.1.2...

Contact Form 7 Captcha < 0.1.2 - Reflected Cross-Site Scripting

The plugin does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers https://example.com/wp-admin/options-general.php?page=cf7sredit&"alert/XSS/...

WordPress Very Simple Contact Form plugin captcha bypass vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. versions of the WordPress Very Simple Contact Form plugin prior to 11.6 have a CAPTCHA bypass vulnerability,...

Malicious code in wix-captcha-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d27319c19c2f96d2e0b7db0575afdfc6bb96004ffd7fdb1b84191dca8bb3c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7161 Malicious code in wix-captcha-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d27319c19c2f96d2e0b7db0575afdfc6bb96004ffd7fdb1b84191dca8bb3c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1801

The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots...

CVE-2022-1801

The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots...

CVE-2022-1801

The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots...

Authentication flaw

The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots...

CVE-2022-1801 Very Simple Contact Form < 11.6 - Captcha bypass

The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots...

CVE-2022-1801

CVE-2022-1801 concerns the WordPress plugin Very Simple Contact Form prior to version 11.6. The vulnerability arises because the CAPTCHA solution is exposed in the rendered form both as hidden input fields and as plain text, allowing bots to easily bypass the captcha check. The impact is that pag...

WordPress plugin Very Simple Contact Form 授权问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. versions of the WordPress Very Simple Contact Form plugin prior to 11.6 have a CAPTCHA bypass vulnerability,...