Description

WordPress Plugin cformsII is prone to an HTML injection vulnerability because it fails to properly sanitize user-supplied input. Attacker supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible. WordPress Plugin cformsII version 15.0.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 15.0.2 or latest

References

https://blog.nintechnet.com/html-injection-vulnerability-in-wordpress-cformsii-plugin/

https://wordpress.org/support/topic/plugin-closed-11/

https://plugins.svn.wordpress.org/cforms2/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin WP Coder-add custom html, css and js code Cross-Site Request Forgery (2.5.2)

WordPress Plugin Instagram Feed Cross-Site Scripting (1.4.6.2)

WordPress Plugin Ad Manager by WD-Advanced Ad Manager Multiple Vulnerabilities (1.0.11)

Internet Information Services Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2002-1700)

WordPress Plugin Simplr Registration Form Plus+ Privilege Escalation (2.4.3)

Severity

High

Classification

CVE-2019-15238 CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Tags

Missing Update XSS