CVE-2021-25079

MEDIUM NUCLEI

Contact Form Entries <1.2.4 - Info Disclosure

Title source: llm

Exploitation Summary

CVE-2021-25079 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

Nuclei Templates (1)

Contact Form Entries < 1.2.4 - Cross-Site Scripting

MEDIUMVERIFIEDby r3Y3r53

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/c3d49271-9656-4428-8357-0d1d77b7fc63

Release Notes, Third Party Advisory x_refsource_confirm

https://plugins.trac.wordpress.org/changeset/2629442

Scores

CVSS v3 6.1

EPSS 0.0682

EPSS Percentile 93.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

crmperks/contact_form_entries < 1.2.4

Published Jan 24, 2022

Tracked Since Feb 18, 2026