CVE-2024-12716 – Simple Basic Contact Form – Stored XSS to Admin Creation – POC

The Simple Basic Contact Form (SBCF) plugin is widely used in WordPress for implementing lightweight and efficient contact forms. Despite its focus on security and minimalism, a Stored Cross-Site Scripting (XSS) vulnerability has been identified, allowing an attacker to inject malicious scripts that execute in the browser of an administrator. This article explores the discovery, exploitation, and security implications of this vulnerability while providing recommendations for mitigation.

CVE	CVE-2024-12716
Plugin	Simple Basic Contact Form
Critical	High
All Time	288 469
Active installations	10 000+
Publicly Published	March 19, 2025
Last Updated	March 19, 2025
Researcher	Artyom Krugov
OWASP TOP-10	A7: Cross-Site Scripting (XSS)
PoC	Yes
Exploit	No
Reference	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12716 https://wpscan.com/vulnerability/a9fa48f1-d7fd-4968-a122-937803f186a2/
Plugin Security Certification by CleanTalk
Logo of the plugin

Join the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.

Get Plugin Security Certificate

PSC by Cleantalk

Timeline

Discovery of the Vulnerability

Security researchers discovered that the SBCF plugin does not properly sanitize user input in the “Error Field Attributes” field. This oversight allows an attacker to inject JavaScript payloads that execute when an admin interacts with the affected form. The issue was assigned CVE-2024-12716 and classified as a Stored XSS vulnerability due to its persistence in the database and ability to impact privileged users.

Understanding of XSS attack’s

Stored XSS occurs when malicious scripts are permanently stored on a target server and executed whenever a user accesses the affected page. In the case of WordPress plugins, insufficient input validation can lead to malicious code injection, which can compromise administrator accounts or lead to site-wide infections.

Exploiting the XSS Vulnerability

To exploit this vulnerability, follow these steps:

POC:

1) Navigate to Settings > Contact Form in the WordPress admin panel.
2) Locate the Plugin Options section and clear all existing field values.
3) Inject a malicious XSS payload into the "Error Field Attributes" field
4) Save the settings.
5) Insert the [simple_contact_form] shortcode into a WordPress page.
6) Trigger the XSS payload by interacting with the error notification (clicking the checkbox and submit button).

____

Upon execution, the injected JavaScript runs in the administrator’s browser, potentially leading to further attacks, such as privilege escalation or full site takeover.

Recommendations for Improved Security

To mitigate the risks posed by CVE-2024-12716, administrators should update the Simple Basic Contact Form plugin to the latest patched version once available, ensure all user input fields, especially error messages and custom attributes, are properly sanitized and validated, implement a Content Security Policy (CSP) to restrict script execution sources, limit JavaScript execution in input fields, use sanitization functions such as wp_kses(), restrict permissions for unauthenticated users, regularly review user roles to prevent privilege escalation, and enforce strict input validation to block malicious payloads. To prevent this type of attacks vendor used our methods of prevention.

By taking proactive measures to address Stored XSS vulnerabilities like CVE-2024-12716, WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.

#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #HighVulnerability

Use CleanTalk solutions to improve the security of your website

Artyom k.