Reflected Cross-site Scripting in Mahesh Bisen Contact Form 7 Add-on

CVE-2025-23623

Summary

The Mahesh Bisen Contact Form 7 – CCAvenue Add-on is susceptible to a reflected Cross-site Scripting (XSS) vulnerability. This flaw allows attackers to inject malicious scripts via user input, which may be executed in the browsers of users who click on compromised links. The vulnerability affects versions up to 1.0, enabling exploitation through inadequately sanitized input during the web page generation process. Users of this add-on should take immediate action to secure their applications.

References