CVE-2020-11516

Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary…

published April 7, 2020

CVSS
—
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00712 · 53.1th percentile
Published
2020-04-07T16:55Z
EPSS history
Timeline
  • 07 APR 16:55Z
    Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary…
    cvelistv5