Executive brief
Contact Form to Email is a WordPress plugin used to build and manage website contact forms. A security flaw allows an authorized user to inject malicious code into the name of a form. When an administrator or another staff member views the form management page, this code executes in their browser, potentially allowing the attacker to steal login credentials or take over administrative sessions.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Contact Form to Email plugin version 1.3.24 for WordPress. The vulnerability is located in the form creation component, specifically within the 'form name' field, which fails to properly neutralize script tags before storage and subsequent display. An authenticated attacker with permissions to create or edit forms can inject arbitrary JavaScript. This code executes in the context of any user (such as an administrator) who visits the form management dashboard. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or credential theft. A public proof-of-concept exploit has been disclosed.
Affected products
- Form2Email (CodePeople) Contact Form to Email 1.3.24
Timeline
- 2021-11-11: disclosed: Vulnerability discovered and exploit authored
- 2021-11-15: other: Exploit published to Exploit-DB
- 2026-05-10: advisory: CVE published/updated via VulnCheck and NVD