WordPress Easy Contact Form 1.1.7 Cross Site Scripting

WordPress Easy Contact Form 1.1.7 Cross Site Scripting

WordPress Easy Contact Form plugin version 1.1.7 suffers from a persistent cross site scripting vulnerability.

Steps:

  1. Install WordPress 5.6

  2. Install and activate Contact Form Plugin plugin.

  3. Go to * Contact Form Plugin *plugin section and click on the add new form button.

  4. Fill all required details and click on the save button and capture the request in a proxy tool like burp suite.

  5. Append the JavaScript payload in the “Email Header” field as mentioned below

    1
    *"<sc><svg/onload=alert(454)>"*

  6. You will observe that the payload successfully got stored and reflected into the response and the malicious JavaScript payload got executed successfully and we are getting a pop-up.