CVE-2021-25079

CVE-2021-25079: Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

Vendor Unknown
Product Contact Form Entries – Contact Form 7, WPforms and more
Weakness CWE-79 · XSS
Published January 24, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

Key dates

02Disclosure timeline

January 24, 2022 CVE published
August 3, 2024 Record updated