CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the admin settings interface. Attackers can inject malicious scripts through the page parameter in class-sms-log-display.php to execute arbitrary JavaScript in administrator browsers.
Explanation of Vulnerability in Simple Terms
A cross-site scripting (XSS) vulnerability in International SMS for Contact Form allows an attacker to inject malicious scripts that execute in a visitor's browser when they interact with the plugin. The vulnerability requires user interaction—typically clicking a malicious link or visiting a compromised page. An attacker with no authentication can craft a payload to steal session cookies, redirect users, or deface the contact form interface.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers when they interact with the contact form.
Potential impact on your site
Visitors' browsers can be compromised; session tokens, form data, or credentials may be stolen; site reputation damaged.
Conditions required to exploit
Visitor must click a malicious link or visit a page containing the attacker's payload; no authentication required.
Key dates
External resources
Related vulnerabilities
