CVE-2024-10180
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The Contact Form 7 – Repeatable Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's field_group shortcode in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
<p>This plugin adds repeatable groups of fields to Contact Form 7.</p>
<p><strong>NOTE:</strong> Tested with Contact Form 7 5.7.7.</p>
<h3>Usage</h3>
<h4>Form tab</h4>
<p>Wrap the desired fields with <code>[field_group your_group_id_here][/field_group]</code>. The shortcode accepts additional parameters, in WP shortcode format and in CF7 fields parameters format as well.</p>
<p>Example:</p>
<pre><code>[field_group emails id="emails-groups" tabindex:1]
<label>Your Email (required)[email* your-email]</label>
[radio your-radio use_label_element default:1 "radio 1" "radio 2" "radio 3"]
[select* your-menu include_blank "option1" "option 2"]
[checkbox* your-checkbox "check 1" "check 2"]
[/field_group]
</code></pre>
<h4>Mail tab</h4>
<p>In the mail settings, wrap the fields with your group id. You can use the <code>[group_index]</code> tag to print the group index and an additional <code>__<NUMBER></code> to print a field at a specific index.</p>
<p>Example:</p>
<pre><code>The second email entered by the user was: [your-email__2]
These were the groups:
[emails]
GROUP #[group_index]
Checkbox: [your-checkbox]
E-mail: [your-email]
Radio: [your-radio]
Select: [your-menu]
[/emails]
</code></pre>
<h3>Check out the Wiki</h3>
<ul>
<li><a href="https://github.com/felipeelia/cf7-repeatable-fields/wiki/Hooks" rel="nofollow ugc">Hooks available</a> – How to customize the <em>add</em> and <em>remove</em> buttons</li>
<li><a href="https://github.com/felipeelia/cf7-repeatable-fields/wiki/Frequently-Asked-Questions" rel="nofollow ugc">Frequently Asked Questions</a></li>
</ul>
<h3>Contribute</h3>
<p>You can contribute with code, issues and ideas at the <a href="https://github.com/felipeelia/cf7-repeatable-fields" rel="nofollow ugc">GitHub repository</a>.</p>
<p>If you like the plugin, <a href="https://wordpress.org/support/plugin/cf7-repeatable-fields/reviews/#new-post" rel="ugc">a review</a> is appreciated 🙂</p>