What the vulnerability does
01Description
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
The Contact Form Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in version 3.51. An authenticated user with low privileges can inject malicious scripts into form fields. When other users view the affected content, the scripts execute in their browsers, potentially allowing session hijacking or credential theft. A patch is available in versions after 3.51.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs when other users view the form or its submissions.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other site visitors; may lead to account compromise or data theft.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress account and the victim must view the affected form or submission.
Key dates
06Disclosure timeline
April 5, 2023
CVE published
August 6, 2024
Record updated
