CVE-2021-24134— Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS
Quick assessment
Affected
Unknown Constant Contact Forms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Wordpress Constant Contact Forms是 （Wordpress）开源的一个应用插件。可以让网站直接轻松地捕获访问者信息。 WordPress Constant Contact Forms plugin before 1.8.8 存在跨站脚本漏洞，该漏洞源于未经验证的输入和缺少输出编码，会导致多个存储的跨站脚本漏洞。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-24134
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Constant Contact Forms < 1.8.8 - Multiple Authenticated Stored XSS
Source: CVE Program / CVE List V5
Vulnerability Description
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user (Editor+) to inject arbitrary JavaScript code or HTML in posts where the malicious form is embed.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Wordpress Constant Contact Forms 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Wordpress Constant Contact Forms是 （Wordpress）开源的一个应用插件。可以让网站直接轻松地捕获访问者信息。 WordPress Constant Contact Forms plugin before 1.8.8 存在跨站脚本漏洞，该漏洞源于未经验证的输入和缺少输出编码，会导致多个存储的跨站脚本漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Constant Contact Forms | 1.8.8 ~ 1.8.8 | - |
|
II. Public POCs for CVE-2021-24134
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-24134
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-24134 (1)
Same Patch Batch · Unknown · 2021-03-18 · 27 CVEs total
| CVE-2021-24137 | Blog2Social: Social Media Auto Post & Scheduler < 6.3.1 - Authenticated SQL Injection | |
| CVE-2021-24149 | Modern Events Calendar Lite < 5.16.6 - Authenticated SQL Injection | |
| CVE-2021-24148 | MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple | |
| CVE-2021-24147 | Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS) | |
| CVE-2021-24146 | Modern Events Calendar Lite < 5.16.5 - Unauthenticated Events Export | |
| CVE-2021-24145 | Modern Events Calendar Lite < 5.16.5 - Authenticated Arbitrary File Upload leading to RCE | |
| CVE-2021-24144 | Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection | |
| CVE-2021-24143 | AccessPress Social Icons < 1.8.1 - Authenticated SQL Injection | |
| CVE-2021-24142 | 301 Redirects - Easy Redirect Manager < 2.51 - Authenticated SQL Injection | |
| CVE-2021-24141 | Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection | |
| CVE-2021-24140 | Ajax Load More < 5.3.2 - Authenticated SQL Injection | |
| CVE-2021-24139 | Photo Gallery by 10Web < 1.5.55 - Unauthenticated SQL Injection | |
| CVE-2021-24138 | AdRotate < 5.8.4 - Authenticated SQL Injection | |
| CVE-2021-24123 | PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE | |
| CVE-2021-24136 | Testimonials Widget < 4.0.0 - Multiple Authenticated Stored XSS | |
| CVE-2021-24135 | WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored X | |
| CVE-2021-24133 | ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings | |
| CVE-2021-24132 | Slider by 10Web < 1.2.36 - Multiple Authenticated SQL Injection | |
| CVE-2021-24131 | Anti-Spam by CleanTalk < 5.149 - Multiple Authenticated SQL Injections | |
| CVE-2021-24130 | WP Google Map Plugin < 4.1.5 - Authenticated SQL Injection |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-93549
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via RE -
CVE-2026-97332
User Private Files < 2.2.0 - Unauthenticated Private File Di -
CVE-2026-86817
Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Auth -
CVE-2026-17005
Horizontal Scrolling Announcements <= 2.6 - Contributor+ Sto -
CVE-2026-104118
Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shi
Same weakness: CWE-79
-
CVE-2026-105099
Omega Solution CoinEx Crypto Ticket Attachment Upload ticket -
CVE-2026-105124
W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login -
CVE-2026-103342
WordPress Unlimited Elements For Elementor (Free Widgets, Ad -
CVE-2026-105116
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie -
CVE-2026-105114
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization
V. Comments for CVE-2021-24134
No comments yet