PT-2021-15704 · WordPress · Contact Form 7 Style

Chloe Chamberland · Published 2021-04-05 · Updated 2021-04-20 · CVE-2021-24159

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Style WordPress plugin versions prior to 3.1.9

Description: The issue arises from the lack of sanitization and nonce protection in the custom CSS feature, allowing an attacker to inject malicious JavaScript into a site. This can be achieved by tricking a site's administrator into clicking a link or attachment, which then updates the CSS settings to include the malicious code.

Recommendations: For versions prior to 3.1.9, update to version 3.1.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the custom CSS feature to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24159

Affected Products

Contact Form 7 Style

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-24159 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24159 · Vendor Advisory
• https://wpscan.com/vulnerability/363182f1-9fda-4363-8f6a-be37c4c07aa9 · Note
• https://wordfence.com/blog/2021/02/unpatched-vulnerability-50000-wp-sites-must-find-alternative-for-contact-form-7-style · Note