CVE-2021-25079CWE-79

Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

published January 24, 2022

CVSS
—
EPSS
7%
Percentile
94.0
In the wild
Unconfirmed
What it is

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06790 · 94.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-01-24T08:01Z
EPSS history
Timeline
  • 24 JAN 08:01Z
    Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting
    cvelistv5