CVE-2021-25079 PoC — Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25079.yaml

Associated Vulnerability

Title: Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting (CVE-2021-25079)
Description:The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

Description

The plugin does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →