CVE-2024-13467: WP Contact Form7 Email Spam Blocker <= 1.0.0 - Reflected Cross-Site Scripting
First published: Sat Jan 25 2025(Updated: )
The WP Contact Form7 Email Spam Blocker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WordPress Contact Form 7 | <=1.0.0 | |
| Mr Kalamathiya WP Contact Form 7 Email Spam Blocker | <=1.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-13467?
CVE-2024-13467 has been classified as a high severity vulnerability due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2024-13467?
To fix CVE-2024-13467, update the WP Contact Form7 Email Spam Blocker plugin to a version beyond 1.0.0.
Who is affected by CVE-2024-13467?
CVE-2024-13467 affects users of the WP Contact Form7 Email Spam Blocker plugin for WordPress running version 1.0.0 or earlier.
What type of vulnerability is CVE-2024-13467?
CVE-2024-13467 is a reflected cross-site scripting vulnerability that exploits insufficient input sanitization and output escaping.
Can CVE-2024-13467 be exploited remotely?
Yes, CVE-2024-13467 can be exploited remotely by unauthenticated attackers via the 'post' parameter.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/source
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/wp contact form7
- canonical/wordpress contact form 7
- vendor/mr-kalathiya
- canonical/mr kalamathiya wp contact form 7 email spam blocker
- version/mr kalamathiya wp contact form 7 email spam blocker/1.0.0