Contact Form Email < 1.3.38 – Unauthenticated Stored Cross-Site Scripting | CVE 2023-2718 | Plugin Vulnerabilities

Description

The plugin does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.

Proof of Concept

1. Publish the default form to a page by clicking on "Contact Form to Email" in the sidebar, and the "Publish" button beside the form name.
2. Visit the form on the frontend. Fill in the Email and Subject with arbitrary, valid values. Fill in the Message field with `</textarea><img src=x onerror=alert(/XSS/)>`
3. Submit the form.
4. In the backend, on the "Contact Form to Email" page, click on "Messages" and click the "Edit" button corresponding to the new message.
5. See the XSS has been triggered.

Affects Plugins

contact-form-to-email

Fixed in 1.3.38

References

CVE

URL

https://www.onvio.nl/nieuws/research-day-discovering-vulnerabilities-in-wordpress-plugins

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Andreas Damen

Submitter

Andreas Damen

Verified

Yes

WPVDB ID

8ad824a6-2d49-4f02-8252-393c59aa9705

Timeline

Publicly Published

2023-05-16 (about 2 years ago)

Added

2023-05-16 (about 2 years ago)

Last Updated

2023-08-01 (about 2 years ago)

Other

Published

Title

Published

2025-12-04

Title

Omnipress < 1.6.6 - Authenticated (Author+) Stored Cross-Site Scripting

Published

2021-09-09

Title

Simple Matted Thumbnails <= 1.01 - Reflected Cross-Site Scripting

Published

2022-08-02

Title

Social Slider Feed < 2.0.6 - Admin+ Stored XSS via API Key

Published

2025-06-18

Title

School Management <= 92.0.0 - Reflected Cross-Site Scripting

Published

2025-11-17

Title

Enable SVG, WebP, and ICO Upload < 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads