Stored Cross-Site Scripting in Simple Basic Contact Form Plugin from WordPress
CVE-2024-12716
What is CVE-2024-12716?
The Simple Basic Contact Form plugin for WordPress fails to properly sanitize and escape certain settings, which can expose high privilege users, such as administrators, to Stored Cross-Site Scripting (XSS) attacks. This vulnerability enables attackers to inject malicious scripts that may execute when users interact with compromised settings, even in environments where the unfiltered_html capability is restricted, like multisite setups. It's crucial for users to update to the latest version to mitigate the risk of exploitation.
Affected Version(s)
Simple Basic Contact Form 0 < 20250114
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved