Track Geolocation Of Users Using Contact Form 7
Monthly
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Sensitive data exposure in the Track Geolocation Of Users Using Contact Form 7 WordPress plugin (versions <= 3.0.2) permits remote unauthenticated attackers to retrieve geolocation records collected from Contact Form 7 form submissions with no credentials or user interaction required. The vulnerability is rooted in CWE-201 - sensitive information returned in responses to unauthorized parties - yielding high confidentiality impact consistent with the CVSS vector (C:H/I:N/A:N). No public exploit code has been confirmed and the CVE does not appear in CISA KEV at time of analysis, though the trivial attack prerequisites (AV:N/AC:L/PR:N/UI:N) mean that exploitation would be straightforward once the plugin's vulnerable endpoint is identified.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZealousWeb Track Geolocation Of Users Using Contact Form 7 allows Stored XSS.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.