CVE-2021-25080

6.1 mediumEPSS 84%

Medium (6.1) in crmperks contact form entries. EPSS 84% chance of exploitation in the next 30 days.

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 84% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-01-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

crmperks:contact_form_entries

References

https://plugins.trac.wordpress.org/changeset/2450335
https://wpscan.com/vulnerability/acd3d98a-aab8-49be-b77e-e8c6ede171ac
https://plugins.trac.wordpress.org/changeset/2450335
https://wpscan.com/vulnerability/acd3d98a-aab8-49be-b77e-e8c6ede171ac

Check your stack JSON