PT-2022-9636 · WordPress · Contact Form Entries

Gaetano Perrone · Published 2022-01-03 · Updated 2022-01-28 · CVE-2021-25080

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Contact Form Entries WordPress plugin versions prior to 1.1.7

Description The issue allows unauthenticated attackers to perform Cross-Site Scripting attacks against logged-in admins viewing the created entry. This is due to the plugin not validating, sanitizing, and escaping the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR.

Recommendations For versions prior to 1.1.7, update to version 1.1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality for unauthenticated users until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-25080

Affected Products

Contact Form Entries

References · 6

• 🔥 https://wpscan.com/vulnerability/acd3d98a-aab8-49be-b77e-e8c6ede171ac · Exploit
• https://osv.dev/vulnerability/CVE-2021-25080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25080 · Security Note
• https://plugins.trac.wordpress.org/changeset/2450335 · Patch
• https://t.me/cibsecurity/36109 · Telegram Post
• https://t.me/defcon_news/92700 · Telegram Post