WordPress Contact Form Check Tester 1.0.2 Plugin - Broken Access Control Vulnerability

Exploit Title: WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control Author: 0xB9 Software Link: https://wordpress.org/plugins/contact-fo...ck-tester/ Version: 1.0.2 Tested on: Windows 10 CVE: CVE-2021-24247 1. Description: The plugin settings are visible to all registered user...

CVE-2021-24247 Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)

The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user...

CVE-2021-24247

CVE-2021-24247 relates to the WordPress plugin “Contact Form Check Tester” (up to version 1.0.2). The vulnerability arises because plugin settings are visible to all registered users in the dashboard and are not sanitized, allowing a user (e.g., a subscriber) to insert an XSS payload that can be ...