CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting the form_id parameter. Attackers can craft malicious URLs to code_generator.php with script payloads in the form_id parameter to execute arbitrary JavaScript in victim browsers.
Explanation of Vulnerability in Simple Terms
Contact Form Builder contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form submissions. An attacker can craft a malicious link or form input that, when visited or submitted by a site visitor, executes JavaScript in their browser. This can lead to session hijacking, credential theft, or defacement of the contact form interface.
What an attacker can do
Inject and execute malicious JavaScript in visitors' browsers through form inputs or links.
Potential impact on your site
Visitors' sessions and data submitted via contact forms are at risk of compromise; site reputation may be damaged.
Conditions required to exploit
Site visitor must interact with a malicious link or submit a crafted form (user interaction required; no authentication needed).
Key dates
External resources
Related vulnerabilities
