Ultimate Addons for Contact Form 7 < 3.1.29 – Reflected XSS | CVE 2023-2803 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

1. Ensure Contact Form 7 is installed, along with this plugin
2. Visit Contact > Ultimate Addons, ensure "Database" is checked, and click Save.
3. Visit Contact > Ultimate DB, select a form, and Submit.
4. In the URL, append the following payload, and see the alert upon loading the new page: &s=%3Cimg%20src=x%20onerror=alert(/XSS/)%3E

Affects Plugins

ultimate-addons-for-contact-form-7

Fixed in 3.1.29

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Henry1601

Submitter

Henry1601

Verified

Yes

WPVDB ID

ec640d47-bb22-478d-9668-1dab72f12f8d

Timeline

Publicly Published

2023-07-24 (about 2 years ago)

Added

2023-07-24 (about 2 years ago)

Last Updated

2023-07-24 (about 2 years ago)

Other

Published

Title

Published

2024-10-31

Title

Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2024-11-05

Title

Pricing Tables WordPress Plugin – Easy Pricing Tables < 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute

Published

2023-06-13

Title

Church Admin < 3.7.30 - Reflected XSS

Published

2024-04-23

Title

Premium Addons for Elementor < 4.10.29 - Contributor+ Stored Cross-Site Scripting

Published

2015-04-20

Title

Ninja Forms <= 2.9.10 - Cross-Site Scripting (XSS)