Non notée
CVE-2021-24134 Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8,…
Description
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Constant Contact Forms 1.8 | premières → < 1.8.8 | 1.8.8 |