CVE-2021-24276 PoC — Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS)

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24276.yaml

Associated Vulnerability

Title: Contact Form by Supsystic < 1.7.15 - Reflected Cross-Site scripting (XSS) (CVE-2021-24276)
Description:The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

Description

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →