WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact
WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact

WordPress Plugin Vulnerabilities

Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)

Description

The plugin settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.

Proof of Concept

Register an account (subscriber role)
Navigate to the dashboard
Go to CF7 Check Tester -> Settings
Add a form, then add a field to the form
Put in a payload in either Field selector or Field value "><script>alert(/XSS/)</script> 

Affects Plugins

contact-form-check-tester
No known fix - plugin closed

References

CVE
CVE-2021-24247

Classification

Type

ACCESS CONTROLS

OWASP top 10
A5: Broken Access Control
CWE
CWE-284

Miscellaneous

Original Researcher

0xB9

Submitter

0xB9

Submitter twitter
0xB9sec
Verified

Yes

WPVDB ID
e2990a7a-d4f0-424e-b01d-ecf67cf9c9f3

Timeline

Publicly Published

2021-04-10 (about 1 years ago)

Added

2021-04-10 (about 1 years ago)

Last Updated

2021-04-12 (about 1 years ago)

Our Other Services

WPScan WordPress Security Plugin
WPScan

Vulnerabilities

WordPressPluginsThemesOur StatsSubmit vulnerabilities

About

How it worksPricingWordPress pluginNewsContact

For Developers

StatusAPI detailsCLI scanner

Other

PrivacyTerms of serviceSubmission termsDisclosure policyPrivacy Notice for California Users
jetpackIn partnership with Jetpack
githubtwitterfacebook
Angithubendeavor
Work With Us