Contact Bank Vulnerabilities

[en] The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 3.0.30

Fix:

No patched version reported

Disclosed:

Oct 25, 2022

CVE-2022-3350 on NVD →

The Contact Bank plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.0.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in p...

CVSS:

5.5

Affected:

up to 3.0.30

Fix:

No patched version reported

Disclosed:

Sep 30, 2022

CVE-2022-3350 on NVD →

The Contact Bank – Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions before 2.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

CVSS:

6.1

Affected:

up to 2.1.23

Fixed in:

2.1.23

Disclosed:

Aug 1, 2016

The Contact Bank – Contact Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions before 2.1.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts i...

Affected:

up to 2.1.23

Fixed in:

2.1.23

Disclosed:

Aug 1, 2016

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 2.1.23

Fixed in:

2.1.23

Disclosed:

Aug 1, 2016

The Contact Bank plugin for WordPress is vulnerable to Cross-Site Scripting via the 'form_id' parameter in versions before 2.0.226 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 2.0.226

Fixed in:

2.0.226

Disclosed:

Aug 13, 2015

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Upgrade the plugin.

Affected:

up to 2.0.226

Fixed in:

2.0.226

Disclosed:

Aug 13, 2015

The Contact Bank plugin for WordPress is vulnerable to Cross-Site Scripting via the 'form_id' parameter in versions before 2.0.226 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 2.0.226

Fixed in:

2.0.226

Disclosed:

Aug 13, 2015

The Contact Bank – Contact Form Builder for WordPress for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ux_dropdown’ and ‘ux_checkbox’ parameter in versions up to, and including, 2.0.69 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVSS:

7.2

Affected:

up to 2.0.69

Fixed in:

2.0.70

Disclosed:

Nov 5, 2014

CVE-2014-8807 on NVD →

Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

CVSS:

6.1

Affected:

up to 2.0.227

Fixed in:

2.0.227

Disclosed:

Aug 1, 2014

CVE-2013-6837 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Label field, related to form layout configuration. NOTE: some of these details are obtained from third party information.

Affected:

up to 2.0.20

Fixed in:

2.0.20

Disclosed:

May 22, 2014

CVE-2014-3841 on NVD →

Cross-site scripting (XSS) vulnerability in the Contact Bank plugin before 2.0.20 for WordPress allows remote attackers to inject arbitrary web script or HTML via the Label field, related to form layout configuration. NOTE: some of these details are obtained from third party information.

CVSS:

6.1

Affected:

up to 2.0.19

Fixed in:

2.0.20

Disclosed:

Apr 28, 2014

CVE-2014-3841 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

Affected:

up to 2.0.227

Fixed in:

2.0.227

Disclosed:

Dec 19, 2013

CVE-2013-6837 on NVD →

The jQuery prettyPhoto library bundled with many plugins was found to be vulnerable to DOM Cross-Site Scripting (XSS).

Affected:

up to 2.0.227

Fixed in:

2.0.227

The Contact Bank – Contact Form Builder for WordPress WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 2.1.23

Fixed in:

2.1.23

The Contact Bank – Contact Form Builder for WordPress WordPress plugin was affected by an Authenticated Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 2.0.226

Fixed in:

2.0.226

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 2.0.70

Fixed in:

2.0.70

CVE-2014-8807 on NVD →