| Package | Affected versions | Patched versions |
|---|---|---|
| contact form 7 | ≤ 3.1.9 |
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free