CVE:CVE-2008-0197
CNNVD:CNNVD-200801-132
WP-ContactForm 1.5 alpha以及更早的WordPress plugin版本下的wp-contact-form/options-contactform.php中的多个跨站脚本漏洞允许远程攻击者通过以下八种方式注入任意的Web脚本或者HTML：
(1)wpcf_email,(2)wpcf_subject,(3)wpcf_question,(4)wpcf_answer,(5)wpcf_success_msg,(6) wpcf_error_msg,(7)wpcf_msg parameter to wp-admin/admin.php,或者(8)the SRC attribute of an IFRAME element。
solution:Upgrade wordpress wp-contactform to a higher version than 1.5_alpha,and avoid the version (,1.5_alpha]