CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max K UTM tags tracking for Contact Form 7 cf7-utm-tracking allows Reflected XSS.This issue affects UTM tags tracking for Contact Form 7: from n/a through <= 2.1.
Explanation of Vulnerability in Simple Terms
UTM tags tracking for Contact Form 7 versions 2.1 and earlier contains a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts into UTM tag parameters that execute in a victim's browser when they visit a crafted link. The vulnerability requires user interaction and can affect other users or administrators viewing the form data. Update to a version newer than 2.1.
What an attacker can do
Inject malicious JavaScript that runs in visitors' browsers when they click a crafted link with malicious UTM parameters.
Potential impact on your site
Attackers can steal admin session cookies, deface forms, or redirect visitors to phishing sites via UTM parameter injection.
Conditions required to exploit
Victim must click a link containing malicious UTM parameters; no authentication required.
Key dates
External resources
Related vulnerabilities
