Skip to content
Sign in
Not rated

CVE-2021-25080 The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved…

Description

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

Affected products and versions

Product Affected versions Fixed in
Contact Form Entries – Contact Form 7, WPforms and more 1.1 earliest → < 1.1.7 1.1.7

Other CVEs of Contact Form Entries – Contact Form 7, WPforms and more

The 2 CVEs of Contact Form Entries – Contact Form 7, WPforms and more →
CVE-2021-25079 The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id,… Not rated
Track this CVE