Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24159Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High 8.8
In plain English
A high-severity cross-site request forgery in Contact Form 7 Style from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Official description
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Contact Form 7 Style | 3.1.9 – through 3.1.9 |
Weakness: CWE-352