Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS

Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.

N/A

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Wordpress Constant Contact Forms 跨站脚本漏洞

Wordpress Constant Contact Forms是 （Wordpress）开源的一个应用插件。可以让网站直接轻松地捕获访问者信息。 WordPress Constant Contact Forms plugin before 1.8.8 存在跨站脚本漏洞，该漏洞源于未经验证的输入和缺少输出编码，会导致多个存储的跨站脚本漏洞。

N/A

N/A