CVE-2021-25063

MEDIUMNuclei

Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS)

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-25063 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Skins for Contact Form 7

CVE List2.5.1 to < 2.5.1affected

Nuclei templates

1
ProjectDiscoveryMEDIUMWordPress Contact Form 7 Skins <=2.5.0 - Cross-Site ScriptingCVSS 6.1

WordPress Contact Form 7 Skins plugin 2.5.0 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the tab parameter before outputting it back in an admin page.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into the website, potentially leading to unauthorized access, data theft, or defacement.

Remediation

Update to the latest version of the WordPress Contact Form 7 Skins plugin (2.5.1) or apply the vendor-supplied patch.

WeaknessesCWE-79
AuthorsdhiyaneshDk
Template tagscve2021cvewpscanwordpresswp-pluginxsscontactformauthenticatedcf7skinsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:cf7skins:contact_form_7_skins:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/e2185887-3e53-4089-aa3f-981c944ee0bb https://nvd.nist.gov/vuln/detail/CVE-2021-25063 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2