Vulnerability feed

Executive summary

A cross-site scripting flaw affects the Contact Form Email WordPress plugin made by Codepeople, versions 1.3.68 and earlier. The advisory rates it medium priority with a CVSS severity of 7.1 and says attackers could use it to steal visitor data or hijack accounts. The vendor's recommendation is to update the plugin to version 1.3.69 or later.

Technical summary

The flaw is a stored cross-site scripting (XSS) issue classified under OWASP A3: Injection, caused by improper neutralization of input during web page generation. The advisory states the required privilege is unauthenticated, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are stated as 1.3.68 and earlier, and the patched version is 1.3.69. The advisory gives the CVSS severity as 7.1 and says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated. No workarounds beyond the mitigation rule are stated, and no detection guidance or confirmed in-the-wild exploitation is stated, though it says the flaw is expected to become exploited.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affects

codepeoplecodepeople Contact Form Email