CVE-2021-42361: Contact Form Email <= 1.3.24 Authenticated Stored Cross-Site Scripting
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfilteredhtml is disabled for administrators, and sites where unfilteredhtml is disabled.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2021-42361?
CVE-2021-42361 is classified as a high severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2021-42361?
To fix CVE-2021-42361, you should update the Contact Form Email plugin to version 1.3.25 or later.
Who is affected by CVE-2021-42361?
CVE-2021-42361 affects users of the Contact Form Email plugin for WordPress versions up to and including 1.3.24.
What type of vulnerability is CVE-2021-42361?
CVE-2021-42361 is a stored cross-site scripting (XSS) vulnerability.
Can attackers exploit CVE-2021-42361 remotely?
Yes, attackers with administrative user access can exploit CVE-2021-42361 remotely.