Calculation For Contact Form 7
Monthly
Unauthenticated cross-site scripting (XSS) in the Calculation For Contact Form 7 WordPress plugin (all versions up to and including 1.0) allows a remote unauthenticated attacker to inject malicious scripts into pages viewed by other users. With no privileges required and a scope change confirmed by the CVSS vector (S:C), a successful exploit executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential harvesting, or UI redressing. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic targeting straightforward once a vulnerable site is discovered.
Unauthenticated cross-site scripting (XSS) in the Calculation For Contact Form 7 WordPress plugin (all versions up to and including 1.0) allows a remote unauthenticated attacker to inject malicious scripts into pages viewed by other users. With no privileges required and a scope change confirmed by the CVSS vector (S:C), a successful exploit executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential harvesting, or UI redressing. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic targeting straightforward once a vulnerable site is discovered.