CVE-2022-0250

MEDIUMNuclei

Redirection for Contact Form 7 < 2.5.0 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0250 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Redirection for Contact Form 7

CVE List2.5.0 to < 2.5.0affected

Nuclei templates

1
ProjectDiscoveryMEDIUMRedirection for Contact Form 7 < 2.5.0 - Cross-Site ScriptingCVSS 6.1

The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting.

Impact

Allows attackers to execute malicious scripts in the context of a user's browser session

Remediation

Update Redirection for Contact Form 7 Plugin to the latest version to mitigate CVE-2022-0250

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2022wordpresswpwp-pluginwpcf7contact-form7xssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:redirection-for-contact-form7:redirection_for_contact_form_7:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/wpcf7-redirect"
https://wpscan.com/vulnerability/05700942-3143-4978-89eb-814ceff74867 https://nvd.nist.gov/vuln/detail/CVE-2022-0250

Source: ProjectDiscovery

References

2