What the vulnerability does
01Description
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
Explanation of Vulnerability in Simple Terms
02Summary
The Contact Form Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions 1.3.4 and earlier. An authenticated user with low privileges can inject malicious scripts into form fields. When another user views the affected form or its data, the script executes in their browser, potentially compromising their session or stealing information.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute when other users view form data or pages.
Potential impact on your site
04Site Impact
Authenticated users can inject scripts affecting other site visitors; may compromise admin sessions or steal user data.
Conditions required to exploit
05Prerequisites
Attacker must be logged in with low-level user privileges and the victim must view the affected form or data.
Key dates
06Disclosure timeline
April 9, 2023
CVE published
August 6, 2024
Record updated
