Lucene search
Jeremie AmsellemWPVDB-ID:6EE14423-F7FF-4433-987A-A1A6B7BD65E3HistoryNov 23, 2021 - 12:00 a.m.
IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting
2021-11-2300:00:00
Jeremie Amsellem
wpscan.com
8
idpay
plugin
xss
vulnerability
contact form 7
security
reflected cross-site scripting
EPSS
0.001
Percentile
40.2%
The plugin does not sanitise and escape the idpay_error parameter before outputting it back in the page leading to a Reflected Cross-Site Scripting
PoC
Append the following payload on a page where a form with an idPay payment interface is embed: &idpay;_error= Example: https://example.com/contact-form/?idpay_error=<script>alert(/XSS/)</script>
Related
prion
prion
Cross site scripting
2022-03-14 15:15:00
wpexploit
wpexploit
IDPay for Contact Form 7 <= 2.1.2 - Reflected Cross-Site Scripting
2021-11-23 00:00:00
nvd
nvd
CVE-2021-24996
2022-03-14 15:15:08
patchstack
patchstack
cve
cve
CVE-2021-24996
2022-03-14 15:15:08
cvelist
cvelist