Contact Form by Supsystic, ee9cc8181b6fbf4a08f9bd0eb66012c33de76e3d

CVE, Research URL: ee9cc8181b6fbf4a08f9bd0eb66012c33de76e3d
Home page URL: Security reports for Contact Form by Supsystic
Application: Contact Form by Supsystic
Published on: Oct 28, 2021
Research Description: Contact Form by Supsystic [contact-form-by-supsystic] < 1.7.20 Contact Form by Supsystic < 1.7.20 - Authenticated (Admin+) Stored Cross-Site Scripting The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fields label in versions before 1.7.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with admin-level privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: max 1.7.20.
Status: vulnerable