Business Essentials For Contact Form 7
Monthly
Unauthenticated stored cross-site scripting (XSS) in the WordPress plugin Business Essentials for Contact Form 7 (versions ≤1.2.1) allows remote attackers to inject arbitrary web scripts via the 'gateway' form field, which execute when a user views the injected page. Exploitation requires a non-default configuration-the plugin's Payments module must be enabled and a form must be set to accept both PayPal and Stripe as payment gateways-substantially narrowing the affected population. No public exploit code has been identified at time of analysis, and while the CVSS score is 7.2 (High), the specific prerequisites and limited browser-context impact (C:L/I:L, no availability impact) result in a low net real-world priority. A fix is available in plugin changeset 3713721 (versions after 1.2.1).
Unauthenticated stored cross-site scripting (XSS) in the WordPress plugin Business Essentials for Contact Form 7 (versions ≤1.2.1) allows remote attackers to inject arbitrary web scripts via the 'gateway' form field, which execute when a user views the injected page. Exploitation requires a non-default configuration-the plugin's Payments module must be enabled and a form must be set to accept both PayPal and Stripe as payment gateways-substantially narrowing the affected population. No public exploit code has been identified at time of analysis, and while the CVSS score is 7.2 (High), the specific prerequisites and limited browser-context impact (C:L/I:L, no availability impact) result in a low net real-world priority. A fix is available in plugin changeset 3713721 (versions after 1.2.1).