Unauthenticated Attackers can Inject Arbitrary Web Scripts through Reflected Cross-Site Scripting in Constant Contact Forms
CVE-2024-9614

6.1MEDIUM

Key Information:

Vendor

Wordpress
Status
Constant Contact Forms
Vendor
CVE Published:
13 November 2024

What is CVE-2024-9614?

The Constant Contact Forms by MailMunch plugin for WordPress exposes a vulnerability due to improper handling of URL parameters using the add_query_arg function. This flaw allows unauthenticated attackers to execute arbitrary web scripts on affected pages. By tricking users into clicking manipulated links, attackers can exploit this vulnerability to gain unauthorized access to sensitive information. All versions leading up to 2.1.2 are susceptible, making it crucial for users to assess and update their plugins promptly to mitigate potential threats.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/constant-conta...
https://plugins.trac.wordpress.org/browser/constant-conta...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.