CVE-2022-0248

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the maliciou...

CVE-2021-24996

The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpayerror parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting...

CVE-2021-24996

The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpayerror parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the maliciou...

CVE-2022-0248 Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the maliciou...

CVE-2022-0248

The CVE-2022-0248 affects the WordPress plugin Contact Form Submissions prior to v1.7.3. The root cause is failure to sanitize/escape additional fields in contact form submissions, allowing unauthenticated attackers to trigger Cross-Site Scripting (XSS) when admins view a malicious submission. Pu...

CVE-2021-24996 IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting

The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpayerror parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting...

CVE-2021-24996

The CVE-2021-24996 entry concerns the WordPress plugin IDPay for Contact Form 7 (≤ 2.1.2). The vulnerability is a Reflected Cross-Site Scripting caused by insufficient sanitisation/escaping of the idpay_error parameter when echoed back on the page, enabling an attacker-controlled payload to execu...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in WordPress...

WordPress plugin Contact Form Submissions 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in versions of the WordPress Contact Form Submissions plugin prior to 1.7.3, which stems from...

CVE-2022-25601

Reflected Cross-Site Scripting XSS vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin versions = 2.4...

CVE-2022-25601

Reflected Cross-Site Scripting XSS vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin versions = 2.4...

Cross site scripting

Reflected Cross-Site Scripting XSS vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin versions = 2.4...

CVE-2022-25601

The CVE-2022-25601 issue affects the WordPress plugin Contact Form X, specifically versions

CVE-2022-25601 WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin versions = 2.4...

CVE-2022-25601 WordPress Contact Form X plugin <= 2.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability affecting parameter &tab discovered in Contact Form X WordPress plugin versions = 2.4...

Material Design for Contact Form 7 <= 2.6.4 - Subscriber+ Arbitrary Settings Update leading to DoS

The plugin does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7mddismissnotice action, allowing any logged in user with roles as low as Subscriber to set arbitrary options to true, potentially leading to Denial of...

WordPress Material Design for Contact Form 7 plugin <= 2.6.4 - Arbitrary Settings Update vulnerability leading to Denial of Service (DoS)

Arbitrary Settings Update vulnerability leading to Denial of Service DoS discovered by Krzysztof Zając in WordPress Material Design for Contact Form 7 plugin versions = 2.6.4. Solution Deactivate and delete. This plugin has been closed as of February 11, 2022 and is not available for download. Th...

WordPress plugin Contact Form X跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in WordPress Contact Form X plugin version 2.4 and earlier. The vulnerability stems from a la...

WordPress Hotscot Contact Form SQL Injection Vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in WordPress Hotscot Contact Form, which stems from a view submission featu...