Vulnerability · Published May 5, 2021 · Assigned by WPScan
CVE-2021-24247Contact Form Check Tester <= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS)
Medium 5.4
In plain English
A medium-severity cross-site scripting in Contact Form Check Tester from MooveAgency. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.7% (higher than 92% of all known vulnerabilities).
Severity (CVSS NVD)5.4Medium
Exploit odds (30 days)4.7%top 8.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MooveAgency | Contact Form Check Tester | 1.0.2 – through 1.0.2 |
Weakness: CWE-79
References
- https://wpscan.com/vulnerability/e2990a7a-d4f0-424e-b01d-ecf67cf9c9f3 x_refsource_CONFIRM