Lucene search
ZhangyunpeiWPEX-ID:C5CA22E0-B7A5-468D-8366-1855FF33851BHistoryDec 02, 2022 - 12:00 a.m.
Simple Basic Contact Form < 20221201 - Admin+ Stored XSS
2022-12-0200:00:00
zhangyunpei
130
contact form
settings
plugin options
email
stored xss
exploit
EPSS
0.001
Percentile
25.3%
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
1. Go to "Settings » Contact Form » Plugin Options" and in "Your Email", add the payload: 1" onmouseenter="alert(/XSS/) "
2. Then click on "Save Settings" and hove the mouse on the "Your Email" field to check the XSS popup.
Related
cvelist
cvelist
CVE-2022-4226 Simple Basic Contact Form < 20221201 - Admin+ Stored XSS
2022-12-26 12:28:12
prion
prion
Cross site scripting
2022-12-26 13:15:00
wpvulndb
wpvulndb
Simple Basic Contact Form < 20221201 - Admin+ Stored XSS
2022-12-02 00:00:00
nvd
nvd
CVE-2022-4226
2022-12-26 13:15:13
cve
cve
CVE-2022-4226
2022-12-26 13:15:13
nvidia
nvidia
Security Bulletin: NVIDIA GPU Display Driver - February 2024
2024-02-28 00:00:00