CVE-2015-4010
Medium
Description
Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.
SeverityMedium
CVSS6.8
Exploit probability—
ProductEverybit Encrypted Contact Form
PublishedJun 9, 2015
First seenJun 9, 2015
How to fix
Update
- everybit encrypted_contact_form1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| everybit encrypted_contact_form | v < 1.1 | 1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.