Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting
25Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 84%
probabilidad de explotación
84%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
Productos afectados
Unknown · Contact Form Entries – Contact Form 7, WPforms and more