.. / CVE-2021-25079

• XSS
• Nuclei
• Web

Exploit for Contact Form Entries < 1.2.4 - Cross-Site Scripting (CVE-2021-25079)

Description:

The plugin does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page

Nuclei Template

View the template here CVE-2021-25079.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-25079.yaml

References: