Bsk Contact Form 7 Blacklist Vulnerabilities

[en] The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected:

up to 1.0.1

Fix:

No patched version reported

Disclosed:

Dec 4, 2023

CVE-2023-5141 on NVD →

The BSK Contact Form 7 Blacklist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inserted_count' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web sc...

CVSS:

6.1

Affected:

up to 1.0.1

Fix:

No patched version reported

Disclosed:

Nov 13, 2023

CVE-2023-5141 on NVD →