PT-2022-9635 · WordPress · Contact Form Entries

Gaetano Perrone · Published 2022-01-07 · Updated 2022-01-28 · CVE-2021-25079

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contact Form Entries WordPress plugin versions prior to 1.2.4

Description The issue concerns the Contact Form Entries WordPress plugin, which does not properly sanitise and escape various parameters, including form id, status, end date, order, orderby, and search, before outputting them back in the admin page. This lack of sanitisation and escaping can lead to potential security issues.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin page or limiting the use of the affected parameters until a patch is applied. Avoid using the parameters form id, status, end date, order, orderby, and search in the admin page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25079

Affected Products

Contact Form Entries

References · 6

• 🔥 https://wpscan.com/vulnerability/c3d49271-9656-4428-8357-0d1d77b7fc63 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25079 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25079 · Vendor Advisory
• https://t.me/defcon_news/93087 · Telegram Post
• https://t.me/cibsecurity/36106 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/2629442 · Note