Cross site scripting

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues...

CVE-2017-18489

The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS...

CVE-2017-18489

CVE-2017-18489 affects the WordPress plugin Contact Form 7 SMS Addon prior to v2.4.0. The vulnerability is a reflected XSS in the file that prints the GET parameter 'to' (vulnerability in plugins/clockwork-two-factor-authentication/templates/clockwork-test-message.php per PoC). Exploitation targe...

CVE-2017-18490

The CVE-2017-18490 entry concerns the WordPress plugin contact-form-multi prior to version 1.2.1, which has multiple XSS issues (CWE-79). The NVD and connected Nuclei/WP- vulnerability data confirm that authenticated attackers can execute arbitrary JavaScript in victims’ browsers, potentially ste...

CVE-2017-18490

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues...

CVE-2017-18491

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues...

CVE-2017-18491

The CVE-2017-18491 entry corresponds to the WordPress plugin “Contact Form by BestWebSoft” up to version 4.0.6, which has multiple XSS flaws. The Nuclei template and related sources confirm the vulnerability affects this plugin and describe the impact: authenticated attackers can inject and execu...

CVE-2016-10869

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS...

CVE-2016-10869

CVE-2016-10869 affects the WordPress plugin contact-form-plugin up to version 4.0.2 . The vulnerability is an XSS flaw in the plugin (WordPress context), with CVSS v3 base score 6.1 (MEDIUM) and CVSS v2 base score 4.3 (MEDIUM) . Multiple sources (NVD, Red Hat, CNVD, CVE lists, WPVulnDB) corrobora...

CVE-2015-9295

The WordPress plugin contact-form-plugin is affected by an XSS vulnerability in versions before 3.96. The issue is described across multiple sources (including Red Hat and CVE records) as a client-side script execution vulnerability in the plugin, with no public exploit details provided in the do...

CVE-2015-9295

The contact-form-plugin plugin before 3.96 for WordPress has XSS...

CVE-2013-7475

CVE-2013-7475 : The WordPress plugin contact-form-plugin is vulnerable to cross-site scripting in all versions before 3.52. The vulnerability is due to an XSS flaw in the plugin and affects the WordPress integration; exploitation details or in-the-wild status are not provided in the documents. No...

CVE-2017-18492

The CVE applies to the WordPress plugin contact-form-to-db,

CVE-2017-18492

The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues...

CVE-2018-20963

The contact-form-to-email plugin before 1.2.66 for WordPress has XSS...

CVE-2018-20963

CVE-2018-20963 affects the WordPress plugin contact-form-to-email , versions prior to 1.2.66. The vulnerability is a cross-site scripting (XSS) flaw caused by insufficient validation of client-side data in the plugin, enabling an attacker to execute arbitrary script in a victim’s browser. Public ...

CVE-2018-20964

CVE-2018-20964 affects the WordPress plugin contact-form-to-email, versions prior to 1.2.66. Root cause: CSRF in the plugin. Impact per CVSS: HIGH (CVSS‑3.0 base 8.8; CVSS‑2.0 base 6.8). Remediation: upgrade to version 1.2.66 or later to mitigate the vulnerability.

CVE-2018-20964

The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF...

CVE-2017-18490: Improper Neutralization of Input During Web Page Generation

The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues...

PT-2019-7024

Name of the Vulnerable Software and Affected Versions contact-form-plugin plugin versions prior to 3.52 for WordPress Description The issue is related to a cross-site scripting XSS problem. There is no information provided about the estimated number of potentially affected devices worldwide or...