PT-2023-16352 · WordPress · Contact-Form-Plugin

Vaibhav Rajput · Publicado 2023-04-10 · Atualizado 2023-04-14 · CVE-2023-0546

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contact Form Plugin WordPress plugin versions prior to 4.3.25

Description The issue allows a logged-in user with roles as low as contributor to inject arbitrary JavaScript into a form. This can be achieved by exploiting the improper sanitization and escaping of the srcdoc attribute in iframes within the plugin's custom HTML field type. The injected JavaScript will trigger for any visitor to the form or for admins previewing or editing the form.

Recommendations For versions prior to 4.3.25, update to version 4.3.25 or later to resolve the issue. As a temporary workaround, consider restricting access to the custom HTML field type in the Contact Form Plugin to prevent potential exploitation until the update can be applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-0546

Produtos afetados

Contact-Form-Plugin

Referências · 4

• 🔥 https://wpscan.com/vulnerability/078f33cd-0f5c-46fe-b858-2107a09c6b69 · Exploit
• https://t.me/cibsecurity/61771 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0546 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0546 · Aviso do Fabricante