Vulnerability · Published Feb 1, 2022 · Assigned by WPScan
CVE-2021-25063Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)
Medium 6.1
In plain English
A medium-severity cross-site scripting in Skins for Contact Form 7 from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)2.1%top 18.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Skins for Contact Form 7 | 2.5.1 – before 2.5.1 |
Weakness: CWE-79