Contact Form Entries < 1.2.1 - Reflected Cross-Site Scripting

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues https://example.com/wp-admin/admin.php?page=vxcfleads&tab=entries&startdate="alert/XSS-startdate/&enddate="alert/XSS-enddate/...

Contact Form Entries < 1.2.1 - Reflected Cross-Site Scripting

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues PoC https://example.com/wp-admin/admin.php?page=vxcfleads=entriesdate="date="...

CVE-2021-24565

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...

Cross site scripting

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...

CVE-2021-24565

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...

CVE-2021-24565

CVE-2021-24565 concerns the WordPress plugin Contact Form 7 Captcha (versions before 0.0.9). The vulnerability combines a CSRF weakness in the settings save flow with a Stored XSS risk caused by unescaped output in attributes. An attacker who has a logged-in user with the manage_options capabilit...

CVE-2021-24565 Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...

PT-2021-16084

Name of the Vulnerable Software and Affected Versions Contact Form 7 Captcha WordPress plugin versions prior to 0.0.9 Description The issue concerns a lack of CSRF check when saving settings, allowing an attacker to manipulate a logged-in user with manage options privileges into changing them...

WordPress plugin Contact Form 7 Captcha 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...

CVE-2021-24565: Improper Neutralization of Input During Web Page Generation

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...

WordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 1.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress W3SCloud Contact Form 7 to Zoho CRM plugin versions = 1.1.0. Solution Update the WordPress W3SCloud Contact Form 7 to Zoho CRM plugin to the latest available version at least 2.1.0...

Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The plugin does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue. PoC All cf7sr parameters a...

Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The plugin does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue. All cf7sr parameters are...

WordPress Contact Form 7 Style plugin <= 3.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Contact Form 7 Style plugin versions = 3.2. Solution This plugin has been closed as of February 1, 2021 and is not available for download. Reason: Security Issue...

WordPress Contact Form Plugin by Fluent Forms <= 3.6.65 - Cross-Site Request Forgery (CSRF) vulnerability leading to stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to stored Cross-Site Scripting XSS discovered by Ramuel Gall WordFence in WordPress Contact Form Plugin by Fluent Forms versions = 3.6.65. Solution Update the WordPress Contact Form Plugin by Fluent Forms to the latest available version at lea...

WordPress Redirection for Contact Form 7 Plugin < 2.3.4 Multiple Vulnerabilities

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability (CNVD-2021-36046)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability (CNVD-2021-36045)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability (CNVD-2021-36044)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...

WordPress Redirection for Contact Form 7 Plugin Improper Access Control Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An improper access control vulnerability exists in WordPress Redirection for Contact Form 7 Plugin...