High · 7.1 CVE-2023-24420 EUVD-2023-28476GHSA-hjrw-wq7f-29c8

WordPress Admin side data storage for Contact Form 7 Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Published Jun 15, 2023 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Zestard Technologies Product: Admin side data storage for Contact Form 7

Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zestard Technologies Admin side data storage for Contact Form 7 plugin <= 1.1.1 versions.

Affected products

Vendor	Product	Affected	Fixed
Zestard Technologies	Admin side data storage for Contact Form 7	≤ 1.1.1	—

References

https://patchstack.com/database/vulnerability/admin-side-data-storage-for-contact-form-7/wordpress-admin-side-data-storage-for-contact-form-7-plugin-1-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve vdb-entry