Slim Jetpack WordPress plugin contact form stored cross-site scripting
Anyone can slip hidden scripts into visitor pages through a website contact form.
Summary
Unauthenticated visitors can store malicious scripts through the 'Website' field of the Slim Jetpack WordPress plugin's contact form. All versions up to and including 2.7.0.1 are affected, and the stored scripts run for users who open the injected page.
Affected when
- A page containing the [contact-form] shortcode
- Slim Jetpack 2.7.0.1 or earlier
What to do
No fixed version is named. Check that the plugin runs a version newer than 2.7.0.1 and read the vendor's advisory.
Products and platforms
CVE IDs
Times
First published
First seen