PT-2024-29426 · WordPress · Simple Basic Contact Form

Krzysztof Zając · Published 2024-05-09 · Updated 2024-05-14 · CVE-2024-4150

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Basic Contact Form plugin for WordPress versions up to and including 20221201

Description The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the scf email parameter. This enables attackers to execute scripts on pages if they can trick a user into performing a specific action, such as clicking on a link.

Recommendations For versions up to and including 20221201, consider disabling the scf email parameter until a patch is available to prevent exploitation. Restrict access to the Simple Basic Contact Form plugin to minimize the risk of arbitrary web script injection. Avoid using the scf email parameter in affected pages until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-4150

Affected Products

Simple Basic Contact Form

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-4150 · Security Note
• https://plugins.trac.wordpress.org/changeset/3080540 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/22074d7a-5dbd-4a0c-bc5d-e4c983e5edb4?source=cve · Note
• https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L122 · Note