Reflected Cross-Site Scripting in Contact Form 7 Redirect & Thank You Page for WordPress

CVE-2024-12423

Summary

The Contact Form 7 Redirect & Thank You Page plugin for WordPress presents a vulnerability that allows unauthenticated attackers to perform Reflected Cross-Site Scripting. This arises from inadequate input sanitization and output escaping in the 'post' parameter, vulnerable in all versions up to and including 1.0.7. If attackers manage to persuade users to interact with malicious links, they may successfully inject arbitrary web scripts that execute within the user's browser context, potentially compromising their session and gaining access to sensitive information.

References