Database for Contact Form 7, WPforms, Elementor forms, CVE-2021-25080

CVE, Research URL: CVE-2021-25080
Home page URL: Security reports for Database for Contact Form 7, WPforms, Elementor forms
Application: Database for Contact Form 7, WPforms, Elementor forms
Published on: Jan 24, 2022
Research Description: The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry
Affected versions: Min -, max 1.2.1.
Status: vulnerable