CVE-2023-2802

Summary

CVE-2023-2802 is a vulnerability affecting the Ultimate Addons for Contact Form 7 plugin before version 3.1.29 for WordPress. This issue permits high privilege users, including admins, to execute Stored Cross-Site Scripting attacks, despite the unfiltered_html capability being disabled. The plugin fails to appropriately sanitize and escape certain settings, leaving them susceptible to malicious scripts. In multisite setups, this vulnerability can pose a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.