4947 matches found
Contact Form by Supsystic < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)
The label field Form name was vulnerable to stored Cross-Site Scripting issue. PoC When creating or editing a form, use the following payload as a Form name label field: "...
WordPress Plugin Supsystic Contact Form 1.7.5 - Multiple Vulnerabilities
Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.5 - Multiple Vulnerabilities Date: 24/07/2020 Exploit Author: Erik David Martin Vendor Homepage: https://supsystic.com/ Software Link: https://downloads.wordpress.org/plugin/contact-form-by-supsystic.1.7.5.zip Version: 1.7.5 Tested on:...
WordPress Contact Form by Supsystic plugin <= 1.7.5 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability found by Erik David Martin in WordPress Contact Form by Supsystic plugin versions = 1.7.5. Solution Update the WordPress Contact Form by Supsystic plugin to the latest available version at least 1.7.7...
WordPress Contact Form by Supsystic plugin <= 1.7.5 - SQL injection (SQLi) vulnerability
SQL injection SQLi vulnerability found by Erik David Martin in WordPress Contact Form by Supsystic plugin versions = 1.7.5. Solution Update the WordPress Contact Form by Supsystic plugin to the latest available version at least 1.7.7...
Contact Form by Supsystic < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)
The label field Form name was vulnerable to stored Cross-Site Scripting issue. When creating or editing a form, use the following payload as a Form name label field: "alert1!--', which will be executed when viewing the "Show All Forms" section, as well as when opening the Contact Details of a use...
WordPress Supsystic Contact Form 1.7.5 XSS / SQL Injection
Exploit Title: WordPress Plugin Supsystic Contact Form 1.7.5 - Multiple Vulnerabilities Date: 24/07/2020 Exploit Author: Erik David Martin Vendor Homepage: https://supsystic.com/ Software Link: https://downloads.wordpress.org/plugin/contact-form-by-supsystic.1.7.5.zip Version: 1.7.5 Tested on:...
Unpatched WordPress Plugin Security Bug Hits 50K
A security bug in Contact Form 7 Style, a WordPress plugin installed on over 50,000 sites, could allow for malicious JavaScript injection on a victim website. The latest WordPress plugin security vulnerability is a cross-site request forgery CSRF to stored cross-site scripting XSS problem in...
Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the plugin. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request coul...
WordPress Contact Form 7 Style plugin <= 3.1.9 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability
Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS vulnerability found by Wordfence Threat Intelligence team in WordPress Contact Form 7 Style plugin versions = 3.1.9. Solution 2021-02-05 - We were unable to find a fixed version of this plugin. WordPress.org notice: "This...
Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the plugin. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request coul...
WordPress Plugin Easy Contact Form 'Name' Cross-Site Scripting Vulnerability
WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. WordPress plugin Easy Contact Form 'Name' cross-site scripting vulnerability. An attacker c...
Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection
The plugin was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files. Attackers can possibly exploit this issue to execute arbitrary commands on the victim's system, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected...
WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.3 - Insufficient Input Sanitization Leading To Authenticated SQL Injection (SQLi) vulnerability
Insufficient Input Sanitization Leading To Authenticated SQL Injection SQLi vulnerability found in WordPress Contact Form 7 Database Addon – CFDB7 plugin versions = 1.2.5.3. Solution Update the WordPress Contact Form 7 Database Addon – CFDB7 plugin to the latest available version at least 1.2.5.4...
Wordpress contact-form-7 code issue vulnerability
Wordpress contact-form-7 is a Wordpress Foundation plugin that provides forms for Wordpress. A security vulnerability exists in contact-form-7 aka Contact Form 7 plugin prior to version 5.3.2 that allows unrestricted file uploads and remote code execution because file names may contain special...
Contact Form 7 Plugin for WordPress < 5.3.2 Arbitrary File Upload
The WordPress Contact Form 7 Plugin installed on the remote host is affected by an unrestricted file upload vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...
WordPress Easy Contact Form 1.1.7 Cross Site Scripting
Exploit Title: WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting XSS Date: 14/01/2021 Exploit Author: Rahul Ramakant Singh Vendor Homepage: https://ghozylab.com/plugins/ Software Link: https://demo.ghozylab.com/plugins/easy-contact-form-plugin/ Version: 1.1.7 Tested on...
Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not properly sanitise the text fields such as Email Subject, Email Recipient, etc when creating or editing a form, leading to an authenticated author+ stored cross-site scripting issue. This could allow medium privilege accounts such as author and editor to perform XSS attacks...
Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not properly sanitise the text fields such as Email Subject, Email Recipient, etc when creating or editing a form, leading to an authenticated author+ stored cross-site scripting issue. This could allow medium privilege accounts such as author and editor to perform XSS attacks...
WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting (XSS)
Exploit Title: WordPress Plugin Easy Contact Form 1.1.7 - 'Name' Stored Cross-Site Scripting XSS Date: 14/01/2021 Exploit Author: Rahul Ramakant Singh Vendor Homepage: https://ghozylab.com/plugins/ Software Link: https://demo.ghozylab.com/plugins/easy-contact-form-plugin/ Version: 1.1.7 Tested on...
WordPress Elementor Contact Form DB plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Elementor Contact Form DB is a WordPress plugin. A cross-site request forgery vulnerability exists in the Wordpress Elementor Contact...