CVE-2008-0197 – WP-ContactForm <= 1.5 - Authenticated (Admin+) Stored Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2008-0197

Multiple cross-site scripting (XSS) vulnerabilities in wp-contact-form/options-contactform.php in the WP-ContactForm 1.5 alpha and earlier plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) wpcf_email, (2) wpcf_subject, (3) wpcf_question, (4) wpcf_answer, (5) wpcf_success_msg, (6) wpcf_error_msg, or (7) wpcf_msg parameter to wp-admin/admin.php, or (8) the SRC attribute of an IFRAME element. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en wp-contact-form/options-contactform.php de la extensión (plugin) WP-ContactForm 1.5 alpha y anteriores para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante los parámetros (1) wpcf_email, (2) wpcf_subject, (3) wpcf_question, (4) wpcf_answer, (5) wpcf_success_msg, (6) wpcf_error_msg, o (7) wpcf_msg parameter a wp-admin/admin.php, o (8) el atributo SRC de un elemento IFRAME. The WP-ContactForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the (1) wpcf_email, (2) wpcf_subject, (3) wpcf_question, (4) wpcf_answer, (5) wpcf_success_msg, (6) wpcf_error_msg, and (7) wpcf_msg parameters or the SRC attribute of an IFRAME element in versions up to, and including, 1.5 alpha due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative capabilities to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html http://securityreason.com/securityalert/3539 http://securityvulns.ru/Sdocument546.html http://securityvulns.ru/Sdocument667.html http://websecurity.com.ua/1600 http://websecurity.com.ua/1641 http://www.securityfocus.com/archive/1/485786/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •