Multiple stored cross-site scripting vulnerabilities in Constant Contact Forms for WordPress 1.8.7 and lower allow high-privileged user (Editor+) to inject arbitrary Javascript code or HTML in posts where the malicious form is embed.
High-privileged user (Editor+) can exploit XSS via Add New Form's form parameters: - Button text - Field Description The stored script is executed for all the users visiting the website. ## Proof of Concept 1. Download and install "Constant Contact Forms for WordPress 1.8.7" from https://wordpress.org/plugins/constant-contact-forms/ 2. Go into "Contact Form" tab from the sidebar and create a new form by clicking on the "Add New Form" button. 3. Input an XSS vector to "Button text", "Field Description" fields, for example: " autofocus=true onfocus='alert(document.domain)'> 4. Save the changes and click on "Publish" (Editor role). 5. By visiting posts that have embedded shortcodes (Ex: `[ctct form="XXX"]`), the javaScript code injected would be executed.
Nguyen Anh Tien - SunCSR (Sun* Cyber Security Research)
Nguyen Anh Tien
Yes
2020-09-06 (about 2 years ago)
2020-09-06 (about 2 years ago)
2021-01-21 (about 2 years ago)