Wordpress Contact Form to Email Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
BID:74693
Info
Wordpress Contact Form to Email Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 74693 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 14 2015 12:00AM |
| Updated: | May 14 2015 12:00AM |
| Credit: | Mahdi.Hidden |
| Vulnerable: |
Codepeople Contact Form to Email 1.1.4 Codepeople Contact Form to Email 1.1.3 Codepeople Contact Form to Email 1.1.2 |
| Not Vulnerable: | |
Discussion
Wordpress Contact Form to Email Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
The Contact Form to Email plugin for WordPress is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks may also be possible.
The Contact Form to Email plugin for WordPress is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks may also be possible.
Exploit / POC
Wordpress Contact Form to Email Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
Solution / Fix
Wordpress Contact Form to Email Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Wordpress Contact Form to Email Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
References:
References:
- Contact Form to Email Product Page (Codepeople)
- WordPress HomePage (WordPress)