Reflected Cross-Site Scripting in BestWebSoft Contact Form Plugin for WordPress
CVE-2024-2198

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Contact Form By Bestwebsoft – Advanced Contact Us Form Builder For WordPress
Vendor
CVE Published:
9 April 2024

Summary

The Contact Form by BestWebSoft plugin for WordPress contains a reflected cross-site scripting vulnerability due to insufficient input sanitization and output escaping. An attacker can exploit this vulnerability by crafting a malicious URL that includes the ‘cntctfrm_contact_address’ parameter. When an unsuspecting user interacts with the link, malicious scripts could be injected into their browser session, potentially allowing attackers to manipulate the webpage or steal sensitive information.

Affected Version(s)

Contact Form by BestWebSoft – Advanced Contact Us Form Builder for WordPress * <= 4.2.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3047840/cont...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Rollings
.