WordPress Plugin Vulnerabilities

Contact List < 2.9.42 - Reflected Cross-Site Scripting

Description

The plugin does not escape the card_height parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting issue

Proof of Concept

Affects Plugins

Plugin icon
contact-list
Fixed in 2.9.42

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
04f12d13-19ee-421e-8c06-066d1d66b841

Timeline

Publicly Published
2021-08-24 (about 4 years ago)
Added
2021-08-24 (about 4 years ago)
Last Updated
2021-08-24 (about 4 years ago)

Other

Published
Title
Published
2026-02-13
Title
WP Data Access < 5.5.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode
Published
2025-04-01
Title
Oracle Cards Lite < 1.2.2 - Reflected Cross-Site Scripting
Published
2024-12-06
Title
Blaze Online eParcel for WooCommerce <= 1.3.3 - Reflected Cross-Site Scripting
Published
2025-06-12
Title
Meks Flexible Shortcodes < 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-01-16
Title
Pootle button <= 1.2.0 - Reflected Cross-Site Scripting