WordPress 插件 Contact Form to Email 1.3.24 存储型跨站脚本漏洞 (XSS) 漏洞概述 漏洞类型: 存储型跨站脚本 (Stored XSS) 认证要求: 需要认证 (Authenticated) EDB-ID: 50524 发布日期: 2021-11-15 作者: Mohammed Aadhil Ashfaq 影响范围 受影响软件: WordPress Plugin Contact Form to Email 受影响版本: 1.3.24 平台: PHP 修复方案 官方主页: https://form2email.dwbooster.com/ 建议: 升级至非受影响版本或应用官方补丁。 POC 代码 ```text Exploit Title: WordPress Plugin Contact Form to Email 1.3.24 - Stored Cross Site Scripting (XSS) (Authenticated) Date: 11/11/2021 Exploit Author: Mohammed Aadhil Ashfaq Vendor Homepage: https://form2email.dwbooster.com/ Version: 1.3.24 Tested on: wordpress POC 1. Click Contact form to Email http://192.168.111.129/wp-admin/admin.php?page=cp_contactformtoemail 2. Create new form name with alert(1) 3. Click Publish 4. XSS has been triggered