Contact Form Manager Vulnerabilities

[en] The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Affected:

up to 1.6.1

Fixed in:

1.6.1

Disclosed:

Jun 1, 2024

CVE-2024-2295 on NVD →

The Contact Form Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [xyz-cfm-form] shortcode in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVSS:

6.4

Affected:

up to 1.6

Fixed in:

1.6.1

Disclosed:

May 31, 2024

CVE-2024-2295 on NVD →

[en] A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected:

up to 1.4.4

Fixed in:

1.4.4

Disclosed:

Jun 16, 2022

CVE-2017-20054 on NVD →

[en] A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be us...

Affected:

up to 1.4.4

Fixed in:

1.4.4

Disclosed:

Jun 16, 2022

CVE-2017-20053 on NVD →

A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS:

8.8

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Mar 1, 2017

CVE-2017-20053 on NVD →

A vulnerability was found in XYZScripts Contact Form Manager Plugin. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS:

6.1

Affected:

up to 1.4.3

Fixed in:

1.4.4

Disclosed:

Mar 1, 2017

CVE-2017-20054 on NVD →

The Contact Form Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formId' parameter for Subscriber+ attackers and 'xyz_cfm_pagelimit', 'xyz_cfm_recaptchaPrivateKey', 'xyz_cfm_recaptchaPublicKey' parameters for Admin+ attackers in versions up to, and including, 1.4.1 due to insuffici...

CVSS:

6.1

Affected:

up to 1.4.1

Fixed in:

1.4.2

Disclosed:

Nov 24, 2015

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

Nov 24, 2015

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

Nov 24, 2015

The Contact Form Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'formId' parameter for Subscriber+ attackers and 'xyz_cfm_pagelimit', 'xyz_cfm_recaptchaPrivateKey', 'xyz_cfm_recaptchaPublicKey' parameters for Admin+ attackers in versions up to, and including, 1.4.1 due to insuffici...

Affected:

up to 1.4.2

Fixed in:

1.4.2

Disclosed:

Nov 24, 2015

The Contact Form Manager WordPress plugin was affected by a CSRF & Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.4.4

Fixed in:

1.4.4

The Contact Form Manager WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 1.4.2

Fixed in:

1.4.2