contactform7 - Cross Site Scripting Vulnerability (XSS)

2022.06.14
ir Mahdi Karimi (IR) ir
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

**************************** #Exploit Title: contactform7 - Cross Site Scripting Vulnerability (XSS) #Date: 2022-06-13 #Exploit Author: Mahdi Karimi #Vendor Homepage: https://contactform7.com/ #Software Link: https://wordpress.org/plugins/contact-form-7/ #Tested On: windows 10 Proof of Concept: 1- localhost/contact-form-7/admin/admin.php > [XSS Inject Payload ] Demo: echo echo esc_attr($_REQUEST['page']); requires: 260: ⇓ function wpcf7_admin_management_page() ************************************************** #Discovered by: Mahdi Karimi #Email : mjoker22mjoker22@gmail.com **************************************************


See this note in RAW Version
Vote for this issue:
75%
25%

Comment it here.
SG | Date: 2022-06-15 10:13 CET+1
Could you please enter some details? Which XSS Inject Payload?
m0ze | Date: 2022-06-21 10:05 CET+1
Another fake, lol. Explanation: you'll get the fatal error right on the first require_once, so it's basically not possible to execute smth here. Not to mention the wrong path like localhost/contact-form-7/, at least it must be localhost/wp-content/plugins/contact-form-7/. Also the line 260 is: $query['message'] = 'failed';.
Mahdi Karimi | Date: 2022-06-29 04:32 CET+1
According to you, I did not see this warning on line 260 $ query ['message'] = 'failed' ;. Maybe there was an error, I ignored it Thanks for your comment. can i help you @m0ze
Copyright 2025, cxsecurity.com

 

Back to Top