WordPress contact-form-7-dynamic-text-extension Plugin Vulnerability Analysis (Stored XSS/CSRF/ReDoS)

Vulnerability Overview This webpage screenshot displays the changelog for the plugin, covering versions 5.0.5 to 5.0.6. The primary fixes address the following security issues: 1. Stored XSS Vulnerability: In the form results page within the admin backend, the form title and shortcode keys were not HTML-escaped, leading to a stored Cross-Site Scripting (XSS) vulnerability. 2. CSRF Vulnerability: The "disable access keys" operation lacked CSRF verification, potentially enabling Cross-Site Request Forgery (CSRF) attacks. 3. Unsanitized Parameter: The parameter was not properly sanitized, potentially leading to security issues. 4. Potential Regular Expression Injection in JavaScript: In the function, the cookie key was not escaped, potentially causing regular expression injection. 5. Context Overwrite Due to Logical Error: In the function, a missing statement caused the user/form context to be overwritten by subsequent code. Affected Scope Affected Versions: 5.0.5 and earlier. Affected Features: The form results page in the admin backend, the disable access keys operation, cookie handling, form context processing, etc. Remediation 1. HTML Escaping: Apply HTML escaping to the form title and shortcode keys in the form results page within the admin backend. 2. CSRF Verification: Add CSRF verification to the "disable access keys" operation. 3. Parameter Sanitization: Properly sanitize the parameter to ensure its value is a non-negative integer. 4. Regular Expression Escaping: Escape the cookie key in the function to prevent regular expression injection. 5. Logical Correction: Add a statement in the function to prevent context overwriting. POC Code The following are example Proof of Concept (POC) codes related to the aforementioned vulnerabilities: Stored XSS Vulnerability CSRF Vulnerability Unsanitized Parameter Potential Regular Expression Injection in JavaScript Context Overwrite Due to Logical Error The above code examples demonstrate how to exploit these vulnerabilities in different scenarios, as well as the corresponding remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress contact-form-7-dynamic-text-extension Plugin Vulnerability Analysis (Stored XSS/CSRF/ReDoS)