CVE-2021-24744

The WordPress Contact Forms by Cimatti WordPress plugin before 1.4.12 does not sanitise and escape the Form Title before outputting it in some admin pages. which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.

CVSS v3.1

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 47th percentile

Published

2021-10-25

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/702a4283-1fd6-4186-9db7-6ad387d714ea

References

• CVE Record
• NVD entry

Related

• CVE-2021-24743
• CVE-2021-24745
• CVE-2021-24742
• CVE-2021-24746
• CVE-2021-24741
• CVE-2021-24747