PT-2021-23593 · WordPress · Contact Form Email

Published 2021-11-17 · Updated 2021-11-18 · CVE-2021-42361

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contact Form Email WordPress plugin versions up to and including 1.3.24

Description The issue arises from insufficient input validation and escaping via the name parameter in the ~/trunk/cp-admin-int-list.inc.php file, allowing attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations where unfiltered html is disabled for administrators, and sites where unfiltered html is disabled.

Recommendations For versions up to and including 1.3.24, update to a version that includes the necessary input validation and escaping fixes to prevent Stored Cross-Site Scripting attacks. As a temporary workaround, consider restricting access to the name parameter in the affected file until a patch is available. Additionally, review and adjust the unfiltered html settings for administrators to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42361

Affected Products

Contact Form Email

References · 4

• https://osv.dev/vulnerability/CVE-2021-42361 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2628041%40contact-form-to-email&new=2628041%40contact-form-to-email&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-42361 · Security Note
• https://wordfence.com/vulnerability-advisories/#CVE-2021-42361 · Note