Database for Contact Form 7, WPforms, Elementor forms, 462d567f3ad1d318c2c19fe5babcbb2da51728f0

CVE, Research URL: 462d567f3ad1d318c2c19fe5babcbb2da51728f0
Home page URL: Security reports for Database for Contact Form 7, WPforms, Elementor forms
Application: Database for Contact Form 7, WPforms, Elementor forms
Published on: Aug 24, 2021
Research Description: Database for Contact Form 7, WPforms, Elementor forms [contact-form-entries] < 1.2.1 Contact Form Entries – Contact Form 7, WPforms and more <= 1.2.0 - Reflected Cross-Site Scripting The Contact Form Entries – Contact Form 7, WPforms and more plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘start_date’ and ‘end_date’ parameters in versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected versions: max 1.2.1.
Status: vulnerable