Executive brief
The Contact Form Builder plugin for WordPress, which allows site owners to create custom contact forms, contains a security flaw that could allow attackers to run malicious scripts in a user's browser. By tricking a site visitor or administrator into clicking a specially crafted link, an attacker could steal login session information or perform unauthorized actions on the website. The plugin has been closed and is no longer available for download due to security concerns.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the wpdevart Contact Form Builder plugin version 1.6.1. The flaw is located in the 'code_generator.php' file, where the 'form_id' parameter is improperly neutralized before being rendered back to the user. An unauthenticated remote attacker can exploit this by crafting a malicious URL containing a JavaScript payload. When a victim visits this URL, the script executes within the context of their browser session, potentially allowing for session hijacking or unauthorized administrative actions. The plugin was officially closed on the WordPress repository in March 2024 due to security issues.
Affected products
- wpdevart Contact Form Builder 1.6.1
Timeline
- 2022-02-07: disclosed: Initial discovery and exploit published by researcher
- 2024-03-07: other: Plugin closed on WordPress.org due to security issues
- 2026-05-10: advisory: CVE published/updated via VulnCheck