WordPress Plugin Vulnerabilities
Ultimate Addons for Contact Form 7 < 3.1.29 - Reflected XSS
Description
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Proof of Concept
1. Ensure Contact Form 7 is installed, along with this plugin 2. Visit Contact > Ultimate Addons, ensure "Database" is checked, and click Save. 3. Visit Contact > Ultimate DB, select a form, and Submit. 4. In the URL, append the following payload, and see the alert upon loading the new page: &s=%3Cimg%20src=x%20onerror=alert(/XSS/)%3E
Affects Plugins
Fixed in 3.1.29 References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Henry1601
Submitter
Henry1601
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2023-07-24 (about 9 months ago)
Added
2023-07-24 (about 9 months ago)
Last Updated
2023-07-24 (about 9 months ago)
WPScan 