Simple Basic Contact Form < 20221201 – Admin+ Stored XSS | CVE 2022-4226 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. Go to "Settings » Contact Form » Plugin Options" and in "Your Email", add the payload: 1" onmouseenter="alert(/XSS/) "

2. Then click on "Save Settings" and hove the mouse on the "Your Email" field to check the XSS popup.

Affects Plugins

simple-basic-contact-form

Fixed in 20221201

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

zhangyunpei and Yeting Li VARAS@IIE

Submitter

zhangyunpei

Verified

Yes

WPVDB ID

c5ca22e0-b7a5-468d-8366-1855ff33851b

Timeline

Publicly Published

2022-12-02 (about 3 years ago)

Added

2022-12-02 (about 3 years ago)

Last Updated

2022-12-02 (about 3 years ago)

Other

Published

Title

Published

2024-01-23

Title

Travelpayouts < 1.1.14 - Reflected XSS

Published

2024-11-04

Title

Conversion Helper <= 1.12 - Reflected Cross-Site Scripting

Published

2022-06-20

Title

WP Duplicate Page < 1.3 - Admin+ Stored Cross Site Scripting

Published

2025-02-03

Title

FlexIDX Home Search <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2023-05-15

Title

Video Carousel Slider with Lightbox < 1.0.23 - Reflected XSS