CVE-2023-28781 HIGH

CVE-2023-28781: WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)

Vendor Cimatti Consulting

Product WordPress Contact Forms by Cimatti

Weakness CWE-79 · XSS

Published April 7, 2023

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.

Explanation of Vulnerability in Simple Terms

02Summary

WordPress Contact Forms by Cimatti versions up to 1.5.4 contain a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts into form fields that execute when site administrators or other users view the submitted data. The vulnerability requires user interaction to trigger but can affect multiple users across the site.

What an attacker can do

03Attacker Capabilities

Inject malicious scripts into contact form submissions that execute in other users' browsers.

Potential impact on your site

04Site Impact

Site visitors or admins viewing form submissions could have their sessions hijacked or credentials stolen.

Conditions required to exploit

05Prerequisites

Attacker must submit a form with malicious input; victim must view the form submission data.

Key dates

06Disclosure timeline

April 7, 2023 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-28781 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities

Identifiers

CVE CVE-2023-28781

CWE CWE-79

CVSS 7.1 / HIGH

Affected versions