CVE-2022-0250 Scanner
CVE-2022-0250 Scanner - Cross-Site Scripting vulnerability in Redirection for Contact Form 7
Short Info
Level
Medium
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
22 days 13 hours
Scan only one
URL
Toolbox
-
Redirection for Contact Form 7 is a WordPress plugin commonly used to add redirection capabilities to contact forms. It allows website owners to redirect users to specific URLs after form submissions. This plugin is widely adopted in WordPress websites for enhancing form functionality and improving user experience. By leveraging this tool, developers and site administrators can achieve seamless user navigation.
The vulnerability detected in this plugin is Cross-Site Scripting (XSS). This occurs because the plugin does not properly escape a generated link before outputting it in an attribute. This vulnerability allows attackers to inject malicious scripts into the web page, which are then executed in the context of a victim's browser.
The XSS vulnerability arises from improper handling of input in specific plugin endpoints, particularly when links are generated and displayed. Attackers can exploit this flaw by crafting malicious URLs that, when visited by a victim, execute arbitrary JavaScript code. This can lead to unauthorized actions, data theft, or compromise of user accounts.
When exploited, this vulnerability allows attackers to execute scripts in the user's browser, potentially stealing session cookies, redirecting users to malicious websites, or performing unauthorized actions on behalf of the user. The impact depends on the context and privileges of the compromised browser session.
REFERENCES
