Magic Tooltips For Contact Form 7
Monthly
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.
Stored cross-site scripting (XSS) in the Magic Tooltips For Contact Form 7 plugin for WordPress (versions up to and including 1.0.34) allows unauthenticated attackers to inject arbitrary JavaScript that executes in an administrator's browser when they view the comment moderation screen at wp-admin/edit-comments.php. The flaw exists because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g., '<tip>') back into live HTML, so an entity-encoded script submitted as a comment author name bypasses sanitize_text_field and is rendered as executable markup. Exploitation requires the site to have comment submission enabled (WordPress default) and a privileged administrator to open the moderation queue; no public exploit code or active exploitation is identified at time of analysis, though the CVSS score of 7.2 (High) reflects the unauthenticated, network-based attack vector and scope change.