Contact Form To Db By Bestwebsoft Messages Database Plugin For Wordpress
Monthly
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.