CVE-2021-24159: Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
Other sources
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24159?
CVE-2021-24159 is a vulnerability in the Contact Form 7 Style WordPress plugin through version 3.1.9 that allows an attacker to inject malicious JavaScript into a site using the plugin.
How does CVE-2021-24159 work?
CVE-2021-24159 works by taking advantage of the lack of sanitization and nonce protection on the custom CSS feature of the Contact Form 7 Style plugin, allowing an attacker to craft a request to inject malicious JavaScript.
What is the severity of CVE-2021-24159?
CVE-2021-24159 has a severity rating of 8.8, which is considered high.
What is the affected software of CVE-2021-24159?
The affected software of CVE-2021-24159 is the Contact Form 7 Style WordPress plugin through version 3.1.9.
How can CVE-2021-24159 be fixed?
To fix CVE-2021-24159, users should update to a version of the Contact Form 7 Style plugin that includes the necessary sanitization and nonce protection measures.