title: Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting
description: The Contact Form Entries WordPress plugin before 1.2.4 does not sanitise and escape various parameters, such as form_id, status, end_date, order, orderby and search before outputting them back in the admin page
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Contact Form Entries – Contact Form 7, WPforms and more
vendor: Unknown
versions:
lessThan: 1.2.4, status: affected, version: 1.2.4, versionType: custom
}