Headline
CVE-2017-20055: Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component.
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev
Full Disclosure mailing list archives
From: Summer of Pwnage <lists () securify nl>
Date: Wed, 1 Mar 2017 07:14:29 +0100
------------------------------------------------------------------------ Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin
Julien Rentrop, July 2016
Abstract
A stored Cross-Site Scripting vulnerability was found in the Contact Form WordPress Plugin. This issue allows an attacker to perform a wide variety of actions, such as stealing users’ session tokens, or performing arbitrary actions on their behalf. In order to exploit this issue, the attacker has to lure/force a victim into opening a malicious website/link.
OVE ID
OVE-20160712-0042
Tested versions
This issue was successfully tested on Contact Form by BestWebSoft WordPress Plugin version 4.0.0.
Fix
This issue is partially resolved in Contact Form version 4.0.2.
Details
https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its goal is to contribute to the security of popular, widely used OSS projects in a fun and educational way.
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Stored Cross-Site Scripting vulnerability in Contact Form WordPress Plugin Summer of Pwnage (Feb 28)