The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Tue, 05 Aug 2025 21:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Emarketdesign
Emarketdesign wp Easy Contact Wordpress Wordpress wordpress |
|
Vendors & Products |
Emarketdesign
Emarketdesign wp Easy Contact Wordpress Wordpress wordpress |
Tue, 05 Aug 2025 14:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Tue, 05 Aug 2025 07:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter | |
Weaknesses | CWE-79 | |
References |
|
|
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2025-08-05T06:39:48.070Z
Updated: 2025-08-05T13:23:20.107Z
Reserved: 2025-07-29T20:35:49.918Z
Link: CVE-2025-8315

Updated: 2025-08-05T13:23:16.032Z

Status : Awaiting Analysis
Published: 2025-08-05T07:15:35.423
Modified: 2025-08-05T14:34:17.327
Link: CVE-2025-8315

No data.