Cross-Site Scripting in Contact Form Email Plugin for WordPress by WordPress
CVE-2019-9646

6.1MEDIUM

Key Information:

Vendor: Wordpress
Status: Contact Form Email
Vendor: CVE Published:; 10 March 2019

What is CVE-2019-9646?

The Contact Form Email plugin for WordPress prior to version 1.2.66 is susceptible to cross-site scripting (XSS) attacks, particularly through wp-admin/admin.php. This vulnerability can be exploited via the 'custom edition area' in the cp_admin_int_edition.inc.php file, enabling unauthorized users to inject malicious scripts. It highlights the importance of timely updates and security measures to protect against potential attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch