Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

2 records

Vendor: CRM Perks Component: Contact Form Entries Clear all filters
TI-2021-07358 CVE-2021-25080 · GHSA-5pmg-vf2j-3wp3

Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting

Priority HIGH 68

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cros…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.842 Published 2022-01-24 Fixed in 1.1.7 CWE-79
TI-2021-07357 CVE-2021-25079 · GHSA-m3hv-p839-hwv6

Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting

Priority LOW 37

The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0679 Published 2022-01-24 Fixed in 1.2.4 CWE-79