4947 matches found
Contact Form Entries < 1.2.1 - Reflected Cross-Site Scripting
The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues https://example.com/wp-admin/admin.php?page=vxcfleads&tab=entries&startdate="alert/XSS-startdate/&enddate="alert/XSS-enddate/...
CVE-2021-24565
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...
Cross site scripting
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...
CVE-2021-24565 Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...
CVE-2021-24565
CVE-2021-24565 concerns the WordPress plugin Contact Form 7 Captcha (versions before 0.0.9). The vulnerability combines a CSRF weakness in the settings save flow with a Stored XSS risk caused by unescaped output in attributes. An attacker who has a logged-in user with the manage_options capabilit...
WordPress plugin Contact Form 7 Captcha 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...
WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 1.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress W3SCloud Contact Form 7 to Zoho CRM plugin versions = 1.1.0. Solution Update the WordPress W3SCloud Contact Form 7 to Zoho CRM plugin to the latest available version at least 2.1.0...
Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS
The plugin does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue. All cf7sr parameters are...
Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS
The plugin does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue. PoC All cf7sr parameters a...
WordPress Contact Form 7 Style plugin <= 3.2 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Contact Form 7 Style plugin versions = 3.2. Solution This plugin has been closed as of February 1, 2021 and is not available for download. Reason: Security Issue...
WordPress Contact Form Plugin by Fluent Forms <= 3.6.65 - Cross-Site Request Forgery (CSRF) vulnerability leading to stored Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to stored Cross-Site Scripting XSS discovered by Ramuel Gall WordFence in WordPress Contact Form Plugin by Fluent Forms versions = 3.6.65. Solution Update the WordPress Contact Form Plugin by Fluent Forms to the latest available version at lea...
WordPress Redirection for Contact Form 7 Plugin < 2.3.4 Multiple Vulnerabilities
The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability (CNVD-2021-36045)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...
WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability (CNVD-2021-36044)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...
WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...
WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability (CNVD-2021-36046)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...
WordPress Redirection for Contact Form 7 Plugin PHP Object Injection Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A PHP object injection vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...
CVE-2021-24278
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7rgetnonce AJAX action to retrieve a valid nonce for any WordPress action/function...
CVE-2021-24282
In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7rresetsettings to reset the plugin’s settings, wpcf7raddaction to...