Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields (such as Email Subject, Email Recipient, etc) when creating or editing a form, leading to an authenticated (author+) stored cross-site scripting issue. This could allow medium privilege accounts (such as author and editor) to perform XSS attacks against high privilege ones like administrator.
Why it matters now
EPSS 0.00628 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Easy Contact Form Pro (Unknown): 1.1.1.9
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Easy Contact Form Pro | 1.1.1.9 to before 1.1.1.9 | 1.1.1.9 | Patch available | CNA |
- Easy Contact Form Pro VendorUnknown Affected 1.1.1.9 to before 1.1.1.9 Fixed in 1.1.1.9 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:easy_contact_form_pro_project:easy_contact_form_pro:*:*:*:*:*:wordpress:*:* | before 1.1.1.9 | Vulnerable | Easy Contact Form Pro Project |
- cpe:2.3:a:easy_contact_form_pro_project:easy_contact_form_pro:*:*:*:*:*:wordpress:*:* Versions before 1.1.1.9 Vulnerable ·Easy Contact Form Pro Project
Remediation
- Fix · CNA Easy Contact Form Pro (Unknown) Fixed in 1.1.1.9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24168
- 2026-10-03 Alias added: GHSA-3jhh-8pq8-rfch
- 2026-10-30 EPSS moved to the 50th–90th percentile
References
Sources
- CVE-2021-24168 · CVE Program
- CVE-2021-24168 · NVD
- FIRST EPSS
- GHSA-3jhh-8pq8-rfch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences