This host is installed with Wordpress Contact Form 7 Integrations and is prone to multiple cross site scripting vulnerabilities.

Successful exploitation will allow attacker to execute arbitrary HTML and script code in a user's browser session in the context of an affected site. Impact Level: Application

Upgrade to version 1.3.11 or later, For updates refer to https://wordpress.org/plugins/contact-form-7-integrations

Flaws are due to the includes/toAdmin.php script does not validate input passed via 'uE' and 'uC' parameters.

Wordpress Contact Form 7 Integrations version 1.0 to 1.3.10

Send a crafted data via HTTP GET request and check whether it is able to read cookie or not.

• http://research.g0blin.co.uk/cve-2014-6445
• http://www.osvdb.com/112170
• https://wordpress.org/plugins/contact-form-7-integrations/changelog

---

Updated on 2015-03-25