GCVE - cpe:2.3:a:contact_form_email:contact_form

Approved changes feed: RSS · Atom

cpe:2.3:a:contact_form_email:contact_form_email:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Contact Form Email (`84fa32a1-35f1-5565-a1ee-a346219b895f`)
Product	Contact Form Email (`692c3f5a-ba50-5c78-8c6d-1850b1a0a558`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-42361`	vulnerable	2026-06-08 05:35:22.214549	Contact Form Email <= 1.3.24 Authenticated Stored Cross-Site Scripting MEDIUM (4.8) The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Published: 2021-11-17T18:27:22.508Z Updated: 2025-02-14T17:51:38.239Z Open on db.gcve.eu Reference links https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42361 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2628041%40contact-form-to-email&new=2628041%40contact-form-to-email&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.