Contact Form 7 Style Vulnerabilities

[en] The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the manage_wp_posts_be_qe_save_post() function. This makes it possible for unauthenticated attackers to quick edit templates via a...

Affected:

up to 3.2

Fix:

No patched version reported

Disclosed:

Jul 1, 2023

CVE-2021-4390 on NVD →

Affected:

up to 3.2

Fix:

No patched version reported

Disclosed:

Jun 7, 2023

CVE-2021-4342 on NVD →

The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the manage_wp_posts_be_qe_save_post() function. This makes it possible for unauthenticated attackers to quick edit templates via a forg...

CVSS:

4.3

Affected:

up to 3.2

Fix:

No patched version reported

Disclosed:

Jun 21, 2021

CVE-2021-4390 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability discovered by Jerome Bruandet (NinTechNet) in WordPress Contact Form 7 Style plugin (versions <= 3.2).

Affected:

up to 3.2

Fix:

No patched version reported

Disclosed:

Jun 21, 2021

[en] Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attach...

Affected:

up to 3.2

Fixed in:

3.2

Disclosed:

Apr 5, 2021

CVE-2021-24159 on NVD →

Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment,...

CVSS:

8.8

Affected:

up to 3.1.9

Fix:

No patched version reported

Disclosed:

Feb 4, 2021

CVE-2021-24159 on NVD →

Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability found by Wordfence Threat Intelligence team in WordPress Contact Form 7 Style plugin (versions <= 3.1.9).

Affected:

up to 3.1.9

Fix:

No patched version reported

Disclosed:

Feb 4, 2021

Multiple plugins are affected by CSRF bypass as they do not properly check for the nonce due to a logic flaw. This could allow attackers to make logged in users do unwanted actions

Affected:

up to 3.2

Fix:

No patched version reported

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Affected:

up to 3.2

Fixed in:

3.2