CVE-2021-25080

CVE-2021-25080: Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting

Vendor Unknown
Product Contact Form Entries – Contact Form 7, WPforms and more
Weakness CWE-79 · XSS
Published January 24, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

Key dates

02Disclosure timeline

January 24, 2022 CVE published
August 3, 2024 Record updated