Reflected Cross-Site Scripting in Contact Form 7 Redirect & Thank You Page for WordPress
CVE-2024-12423
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 15 January 2025
What is CVE-2024-12423?
The Contact Form 7 Redirect & Thank You Page plugin for WordPress presents a vulnerability that allows unauthenticated attackers to perform Reflected Cross-Site Scripting. This arises from inadequate input sanitization and output escaping in the 'post' parameter, vulnerable in all versions up to and including 1.0.7. If attackers manage to persuade users to interact with malicious links, they may successfully inject arbitrary web scripts that execute within the user's browser context, potentially compromising their session and gaining access to sensitive information.
Affected Version(s)
Contact Form 7 Redirect & Thank You Page * <= 1.0.7