Multiple Cross-Site Scripting Vulnerabilities in WP-ContactForm by WordPress

CVE-2008-0197

What is CVE-2008-0197?

The WP-ContactForm plugin for WordPress contains multiple vulnerabilities that allow remote attackers to exploit Cross-Site Scripting (XSS) flaws. Attackers can inject arbitrary web scripts or HTML through maliciously crafted inputs in various parameters including email, subject, question, answer, and error messages. This exploitation can affect users by executing harmful scripts in their browsers, potentially leading to unauthorized actions, data theft, or session hijacking. It is essential for WordPress site administrators to update to a secure version to mitigate these risks.

References