EUVD-2025-17534CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! allows Reflected XSS. This issue affects Formulario de contacto SalesUp!: from n/a through 1.0.14.
AnalysisAI
Reflected Cross-Site Scripting (XSS) vulnerability in the SalesUp! Contact Form plugin (versions up to 1.0.14) that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (clicking a malicious link) but can compromise confidentiality, integrity, and availability across security boundaries (CVSS 7.1). There is no indication of active exploitation in the wild or confirmed proof-of-concept at this time based on available intelligence.
Technical ContextAI
This vulnerability stems from improper input neutralization during web page generation (CWE-79: Improper Neutralization of Input During Web Page Generation). The SalesUp! Contact Form plugin (affected versions: n/a through 1.0.14) fails to properly sanitize or encode user-supplied input before rendering it in HTML responses. The plugin, likely a WordPress plugin based on naming conventions, processes contact form submissions or URL parameters without adequate output encoding, enabling attackers to inject arbitrary JavaScript. The reflected nature means the malicious payload is embedded in a URL and executed in the victim's browser session when clicked, potentially stealing session tokens, performing actions on behalf of the user, or redirecting to phishing pages.
Share
External POC / Exploit Code
Leaving vuln.today