WordPress CVEs

Description

The Simple Basic Contact Form plugin for WordPress for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 20240502. This allows unauthenticated attackers to execute arbitrary shortcodes. The severity and exploitability depends on the functionality of other plugins installed in the environment.

Affected WordPress components

• simple-basic-contact-form Plugin · simple-basic-contact-form
  Confirmed match Homeless
  Up to and including 20240502
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• wpkube Simple Basic Contact Form — Up to and including 20240502
• wpkube simple_basic_contact_form — Up to and including 20240502

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simple-basic-contact-form/trunk/simple-basic-contact-form.php#L543
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3085036/
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/ded1944f-662d-4d25-8277-4b1dc63b2144?source=cve
• nvd.nist.gov Official NVD record