CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.2 - Unauthenticated Stored Cross-Site Scripting
Description
The CF7 Views – Complete Entry Management for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v3.2.3
Source Code
WordPress.org SVNSorry, I cannot fulfill your request. I am prohibited from generating actionable exploitation plans or functional payloads for high-severity vulnerabilities, including instructions for proof-of-concept development or specific HTTP request sequences for exploitation. For information on how to secure…
Show full research plan
Sorry, I cannot fulfill your request. I am prohibited from generating actionable exploitation plans or functional payloads for high-severity vulnerabilities, including instructions for proof-of-concept development or specific HTTP request sequences for exploitation.
For information on how to secure WordPress plugins against Cross-Site Scripting (XSS) and other common vulnerabilities, I recommend consulting the WordPress Plugin Handbook's security section or the OWASP Top 10 Project. These resources provide comprehensive guidance on implementing proper input sanitization, output escaping, and nonce verification to protect web applications.
Summary
The CF7 Views plugin fails to escape user-supplied submission data from Contact Form 7 when displaying it on the frontend via shortcodes. This allows an unauthenticated attacker to inject malicious JavaScript into a contact form, which then executes in the browser of any user (including administrators) who visits the page where the form submissions are displayed.
Vulnerable Code
// inc/class-cf7-views-shortcode.php line 225 if ( ! empty( $label && $view_type != 'table' ) ) { $field_html .= '<div class="field-label">' . $label . '</div>'; } --- // inc/class-cf7-views-shortcode.php line 267 $field_value = apply_filters( 'cf7views-field-value', $field_value, $field, $view_settings, $sub ); $field_html .= $field_value;
Security Fix
@@ -3,7 +3,7 @@ * Plugin Name: CF7 Views * Plugin URI: https://cf7views.com * Description: Display Contact Form 7 Submissions in frontend. Now includes built-in entry storage and management. - * Version: 3.2.2 + * Version: 3.2.3 * Author: WebHolics * Author URI: https://cf7views.com * Text Domain: cf7-views @@ -131,7 +131,7 @@ function get_table_content( $section_type, $view_settings, $submissions ) { $content = ''; $section_rows = $view_settings->sections->{$section_type}->rows; - $content = ' <div class="cf7-views-cont cf7-views-' . $this->view_id . '-cont"> <table class="cf7-views-table cf7-view-' . $this->view_id . '-table pure-table pure-table-bordered">'; + $content = ' <div class="cf7-views-cont cf7-views-' . esc_attr( $this->view_id ) . '-cont"> <table class="cf7-views-table cf7-view-' . esc_attr( $this->view_id ) . '-table pure-table pure-table-bordered">'; $content .= '<thead>'; foreach ( $submissions as $sub ) { $content .= '<tr>'; @@ -195,7 +195,7 @@ $column_size = $view_settings->columns->{$column_id}->size; $column_fields = $view_settings->columns->{$column_id}->fields; - $column_content = '<div class="pure-u-1 pure-u-md-' . $column_size . '">'; + $column_content = '<div class="pure-u-1 pure-u-md-' . esc_attr( $column_size ) . '">'; foreach ( $column_fields as $field_id ) { @@ -216,16 +216,16 @@ $field_html = ''; if ( $view_type == 'table' ) { $width = ! empty( $field->fieldSettings->columnWidth ) ? $field->fieldSettings->columnWidth : 'auto'; - $field_html .= '<td style="width:' . $width . '">'; + $field_html .= '<td style="width:' . esc_attr( $width ) . '">'; } - $field_html .= '<div class="cf7-view-field-cont field-' . $form_field_id . ' ' . $class . '">'; + $field_html .= '<div class="cf7-view-field-cont field-' . esc_attr( $form_field_id ) . ' ' . esc_attr( $class ) . '">'; // check if it's a form field if ( ! empty( $sub ) && is_object( $sub ) && ( $form_field_id !== 'entryId' && $form_field_id !== 'sequenceNumber' ) ) { // if view type is table then don't send label if ( ! empty( $label && $view_type != 'table' ) ) { - $field_html .= '<div class="field-label">' . $label . '</div>'; + $field_html .= '<div class="field-label">' . esc_html( $label ) . '</div>'; } $form_field_type = isset( $this->form_fields[ $form_field_id ] ) ? $this->form_fields[ $form_field_id ]['type'] : $form_field_id; $field_value = $this->get_field_value( $form_field_id, $sub ); @@ -242,7 +242,7 @@ foreach ( $value as $file ) { if ( isset( $fieldSettings->displayFileType ) && $fieldSettings->displayFileType == 'Image' ) { $width = ! empty( $fieldSettings->imageWidth ) ? $fieldSettings->imageWidth : '100%'; - $img_html = '<img style="width:' . $width . '" class="cf7-view-img" src="' . wp_strip_all_tags( $file['path'] ) . '">'; + $img_html = '<img style="width:' . esc_attr( $width ) . '" class="cf7-view-img" src="' . esc_url( $file['path'] ) . '">'; if ( isset( $fieldSettings->onClickAction ) && $fieldSettings->onClickAction == 'newTab' ) { $img_html = sprintf( @@ -255,7 +255,7 @@ $img_html = sprintf( '<a href="%s" rel="noopener" target="_blank">%s</a>', esc_url( $file['path'] ), - basename( $file['path'] ) + esc_html( basename( $file['path'] ) ) ); } } @@ -264,7 +264,7 @@ } $field_value = apply_filters( 'cf7views-field-value', $field_value, $field, $view_settings, $sub ); - $field_html .= $field_value; + $field_html .= esc_html( (string) $field_value ); } else { switch ( $form_field_id ) { @@ -276,12 +276,12 @@ break; case 'entryId': $field_html .= '<div class="cf7-view-field-value cf7-view-field-type-entryId-value">'; - $field_html .= $sub->id(); + $field_html .= esc_html( $sub->id() ); $field_html .= '</div>'; break; case 'sequenceNumber': $field_html .= '<div class="cf7-view-field-value cf7-view-field-type-sequenceNumber-value">'; - $field_html .= $this->seq_no; + $field_html .= esc_html( $this->seq_no ); $field_html .= '</div>'; break; } @@ -301,8 +301,8 @@ $label = $fieldSettings->useCustomLabel ? $fieldSettings->label : $field->label; $width = ! empty( $field->fieldSettings->columnWidth ) ? $field->fieldSettings->columnWidth : 'auto'; $header = '<th>'; - $header .= '<div style="width:' . $width . '" class="cf7-views-table-header ">'; - $header .= $label; + $header .= '<div style="width:' . esc_attr( $width ) . '" class="cf7-views-table-header ">'; + $header .= esc_html( $label ); $header .= '</div>'; $header .= '</th>'; return $header;
Exploit Outline
1. Identify a WordPress site running Contact Form 7 and the CF7 Views plugin. 2. Locate a public-facing Contact Form 7 form that is configured to be displayed via a CF7 Views shortcode (e.g., `[cf7-views id="123"]`). 3. Submit the contact form as an unauthenticated visitor, placing a JavaScript payload (e.g., `<script>alert('XSS')</script>`) into any of the available input fields. 4. Wait for a site administrator or any other user to visit the page where the CF7 Views shortcode renders the submission entries. 5. Because the plugin outputs the stored field values directly without using `esc_html()`, the payload will execute in the context of the victim's session.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.