CVE-2021-24168
Medium
Description
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.
SeverityMedium
CVSS5.4
Exploit probability—
ProductEasy Contact Form Pro
PublishedApr 5, 2021
First seenApr 5, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- easy_contact_form_pro_project easy_contact_form_pro1.1.1.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| easy_contact_form_pro_project easy_contact_form_pro | v < 1.1.1.9 | 1.1.1.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.