CVE-2021-24247CWE-79

Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)

published May 5, 2021

CVSS
—
EPSS
5%
Percentile
91.7
In the wild
Unconfirmed
What it is

The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04682 · 91.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-05-05T18:39Z
EPSS history
Timeline
  • 05 MAY 18:39Z
    Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)
    cvelistv5