Cross-Site Scripting Vulnerability in Clockwork SMS Plugins by WordPress
CVE-2017-17780

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Booking Calendar Sms
Clockwork Sms Notfications
Contact Form 7 Sms
Fast Secure Contact Form Sms
Vendor
CVE Published:
20 December 2017

Summary

The Clockwork SMS component presents a cross-site scripting (XSS) vulnerability through the 'to' parameter within a crafted request to the clockwork-test-message.php file. This issue can be exploited via wp-admin/admin.php, affecting several WordPress plugins that utilize the Clockwork SMS system. Successful exploitation may allow attackers to inject and execute malicious scripts in the context of the affected website, potentially compromising user data and site functionality.

References

https://packetstormsecurity.com/files/145469/Clockwork-SM...
x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/1781424/cloc...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.