CyberSecurityBoard
Sponsor Register Login

Too Much Escaping Backfires, Allows Shortcode-Based XSS Vulnerability in Contact Form Entries WordPress Plugin

On February 24th, 2024, during our second Bug Bounty Extravaganza, we received a submission for a stored Cross-Site Scripting vulnerability in Contact Form Entries, a WordPress plugin with more than 60,000+ active installations.
The vulnerability enables threat actors with contributor-level permissions or higher to inject malicious web scripts into pages using the plugin's shortcode.
Props to Krzysztof Zając who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program.
Our mission is to Secure the Web, so we are proud to continue investing in vulnerability research like this and collaborating with researchers of this caliber through our Bug Bounty Program.
All Wordfence Premium, Wordfence Care, and Wordfence Response customers, as well as those using the free version of our plugin, are protected against any exploits targeting this vulnerability by the Wordfence firewall's built-in Cross-Site Scripting protection.
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping on user supplied attributes.
Contact Form Entries is a plugin designed to allow WordPress users to save form submissions from many other popular contact form plugins to the WordPress database.
It provides a shortcode that displays form entries in a table when added to a WordPress page.
Insecure implementation of the plugin's shortcode functionality allows for the injection of arbitrary web scripts into these pages.
The 'font-size' attribute value is used for id, which is not relevant to the vulnerability.
The most significant problem and vulnerability is caused by the fact that the second esc html() function escapes the quotation marks, meaning that the user input value will no longer be enclosed within quotation marks.
Let's take an example where the shortcode id attribute is used as an HTML attribute, similarly as in the plugin.
February 24, 2024 - We receive the submission of the stored Cross-Site Scripting vulnerability in Contact Form Entries via the Wordfence Bug Bounty Program.
February 29, 2024 - We initiate contact with the plugin vendor asking that they confirm the inbox for handling the discussion.
In this blog post, we detailed a stored Cross-Site Scripting vulnerability within the Contact Form Entries plugin affecting versions 1.3.3 and earlier.
This vulnerability allows authenticated threat actors with contributor-level permissions or higher to inject malicious web scripts into pages that execute when a user accesses an affected page.
The vulnerability has been fully addressed in version 1.3.4 of the plugin.
We encourage WordPress users to verify that their sites are updated to the latest patched version of Contact Form Entries.
All Wordfence users, including those running Wordfence Premium, Wordfence Care, and Wordfence Response, as well as sites running the free version of Wordfence, are fully protected against this vulnerability.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.


This Cyber News was published on www.wordfence.com. Publication date: Mon, 18 Mar 2024 15:28:05 +0000


Cyber News related to Too Much Escaping Backfires, Allows Shortcode-Based XSS Vulnerability in Contact Form Entries WordPress Plugin

Too Much Escaping Backfires, Allows Shortcode-Based XSS Vulnerability in Contact Form Entries WordPress Plugin - On February 24th, 2024, during our second Bug Bounty Extravaganza, we received a submission for a stored Cross-Site Scripting vulnerability in Contact Form Entries, a WordPress plugin with more than 60,000+ active installations. The vulnerability ...
9 months ago Wordfence.com
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 23, 2024 to September 29, 2024) - Software Name Software Slug 012 Ps Multi Languages 012-ps-multi-languages ABC APP CREATOR abcapp-creator Absolute Reviews absolute-reviews Accordion accordions Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads quick-adsense-reloaded Advanced File ...
2 months ago Wordfence.com
Over 100 WordPress Repository Plugins Affected by Shortcode-based Stored Cross-Site Scripting - On August 14, 2023, the Wordfence Threat Intelligence team began a research project to find Stored Cross-Site Scripting via Shortcode vulnerabilities in WordPress repository plugins. We found over 100 vulnerabilities across 100 plugins which affect ...
1 year ago Wordfence.com
CVE-2023-2813 - All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before ...
1 year ago
CVE-2022-48721 - In the Linux kernel, the following vulnerability has been resolved: ...
6 months ago
WordPress Request Architecture and Hooks - Before diving into the security features of WordPress, it's critical to understand the underlying request architecture. WordPress is a dynamic system that processes and responds to user requests in various ways, depending on the nature of the request ...
5 months ago Wordfence.com
CVE-2021-24219 - The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before ...
2 years ago
CVE-2021-24752 - Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top ...
2 years ago
Developer Accounts Compromised Due to Credential Reuse in WordPress.org Supply Chain Attack - On June 24th, 2024, the Wordfence Threat Intelligence Team became aware of a WordPress plugin, Social Warfare, that was infected with malware through the WordPress repository. We immediately notified the WordPress Plugin's Team and they removed the ...
5 months ago Wordfence.com
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
1 year ago Esecurityplanet.com
CVE-2023-24410 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows ...
1 year ago
Record Breaking $153,000+ Already Invested into the Security of the WordPress Ecosystem by Wordfence - In just a few short months since our launch in November of last year, the Wordfence Bug Bounty Program has already awarded over $153,000 in bounties to WordPress security researchers who have been responsibly reporting security issues in WordPress ...
9 months ago Wordfence.com
Type Juggling Leads to Two Vulnerabilities in POST SMTP Mailer WordPress Plugin - On December 14th, 2023, during our Bug Bounty Program Holiday Bug Extravaganza, we received a submission for an Authorization Bypass vulnerability in POST SMTP Mailer, a WordPress plugin with over 300,000+ active installations. This vulnerability ...
11 months ago Wordfence.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com
Why too much data can be detrimental and what to do about it - Cyber threat intelligence attempts to understand adversaries and their potential actions before they occur and prepare accordingly. CTI gathers information about threat actors, their intentions, mechanisms, intended targets and means for doing so as ...
11 months ago Cybersecurity-insiders.com

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)