WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-41863

7.1HIGH

Key Information:

Vendor
WordPress
Status
Peprodev Cf7 Database
Vendor
CVE Published:
25 September 2023

Summary

The PeproDev CF7 Database plugin, developed by Pepro Dev. Group, is susceptible to an unauthenticated stored Cross-Site Scripting (XSS) vulnerability. Attackers can exploit this flaw in versions up to and including 1.7.0 to inject malicious scripts, impacting site integrity and user security. It is crucial for users of this plugin to apply available patches and harden their security measures to safeguard against this type of threat.

Affected Version(s)

PeproDev CF7 Database <= 1.7.0

References

https://patchstack.com/database/vulnerability/pepro-cf7-d...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

FearZzZz (Patchstack Alliance)
.