Cf7 Views 8211 Complete Entry Management For Contact Form 7
Monthly
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
DOM-based cross-site scripting in the WordPress plugin CF7 Views - Complete Entry Management for Contact Form 7 (by Aman) affects all versions from an unspecified start through 3.2.2, letting a remote attacker who lures a user into interacting with a crafted link or page execute arbitrary JavaScript in that user's browser session. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change (S:C), reflecting that script executes outside the vulnerable component's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed via Patchstack.
Stored cross-site scripting (XSS) in the CF7 Views - Complete Entry Management for Contact Form 7 plugin (versions <= 3.2.5) enables an authenticated Contributor-level user to inject malicious scripts that execute in the browser of a higher-privileged victim who views the crafted entry or view. The CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the need for authentication and user interaction, and the potential for limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
DOM-based cross-site scripting in the WordPress plugin CF7 Views - Complete Entry Management for Contact Form 7 (by Aman) affects all versions from an unspecified start through 3.2.2, letting a remote attacker who lures a user into interacting with a crafted link or page execute arbitrary JavaScript in that user's browser session. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change (S:C), reflecting that script executes outside the vulnerable component's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed via Patchstack.
Stored cross-site scripting (XSS) in the CF7 Views - Complete Entry Management for Contact Form 7 plugin (versions <= 3.2.5) enables an authenticated Contributor-level user to inject malicious scripts that execute in the browser of a higher-privileged victim who views the crafted entry or view. The CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), reflecting the need for authentication and user interaction, and the potential for limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.