title: WordPress Enhanced WP Contact Form Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)
description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joost de Valk Enhanced WP Contact Form plugin <= 2.2.3 versions.
problem types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: enhanced-wordpress-contactform
product: Enhanced WP Contact Form
vendor: Joost de Valk
versions:
changes: [at: 2.3, status: unaffected], lessThanOrEqual: 2.2.3, status: affected, version: n/a, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: The vulnerability was patched in the 2.3 version. However, you should look for alternative software as the author no longer supports this plugin, and it has been removed from the WordPress repository.