Non notée
CVE-2021-25080 The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved…
Description
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Contact Form Entries – Contact Form 7, WPforms and more 1.1 | premières → < 1.1.7 | 1.1.7 |