Contact Form Db For Enfold
Monthly
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).