Contact Form Submissions < 1.7.3 - Unauthenticated Stored XSS
CVE-2022-0248

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Contact Form Submissions
Vendor
CVE Published:
14 March 2022

Summary

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission

Affected Version(s)

Contact Form Submissions 1.7.3

References

https://wpscan.com/vulnerability/d02cf542-2d75-46bc-a0df-...
x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2682024
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yoru Oni
.