Cross site scripting

The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the insertedcount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-5141

CVE-2023-5141 affects the BSK Contact Form 7 Blacklist plugin for WordPress up to version 1.0.1. The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by inadequate sanitization/escaping of the inserted_count parameter when it is output on the page. Attack scenario: an unauthenticate...

CVE-2023-5141: Improper Neutralization of Input During Web Page Generation

The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the insertedcount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2023-31810

Name of the Vulnerable Software and Affected Versions BSK Contact Form 7 Blacklist WordPress plugin versions 1.0.1 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the inserted count parameter is not properly sanitized and escaped before...

WordPress BSK Contact Form 7 Blacklist Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software BSK Contact Form 7 Blacklist Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5141 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bcd35c27eb27 Credits Enrico...

BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape the insertedcount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open the URL below...

BSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape the insertedcount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open the URL below...