.. / CVE-2022-0595

• XSS
• Nuclei
• Web

Exploit for WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting (CVE-2022-0595)

Description:

WordPress Contact Form 7 before 1.3.6.3 contains an unauthenticated stored cross-site scripting vulnerability in the Drag and Drop Multiple File Upload plugin. SVG files can be uploaded by default via the dnd_codedropz_upload AJAX action.

Nuclei Template

View the template here CVE-2022-0595.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-0595.yaml

References: