CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thehowarde Connect Contact Form 7 to Constant Contact connect-contact-form-7-to-constant-contact-v3 allows Reflected XSS.This issue affects Connect Contact Form 7 to Constant Contact: from n/a through <= 1.4.
Explanation of Vulnerability in Simple Terms
Connect Contact Form 7 to Constant Contact versions 1.4 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they interact with the contact form. The vulnerability requires user interaction and can affect multiple users across the site. Update to a version newer than 1.4 to resolve this issue.
What an attacker can do
Inject malicious scripts that run in visitors' browsers when they use the contact form.
Potential impact on your site
Attackers can steal visitor data, redirect users, or deface the contact form without needing site admin access.
Conditions required to exploit
Visitor must interact with the affected contact form on the site; no authentication required.
Key dates
External resources
Related vulnerabilities
