Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSS
Description
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <1.1.29
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization and output escaping in plugin settings allows stored XSS."
Attack vector
An attacker with Contributor-level privileges (or higher) can inject malicious JavaScript into a plugin setting that is later rendered without proper escaping. When an administrator or other user views the affected settings page, the stored script executes in their browser session, leading to Stored Cross-Site Scripting (XSS) [CWE-79] [ref_id=1]. The attack requires only the ability to edit plugin settings, which is available to Contributor roles in WordPress.
Affected code
The plugin's settings page does not sanitize or escape user-supplied input before storing or rendering it. The advisory does not specify exact file or function names, but the vulnerability resides in the settings-handling code of the Contact Form Lite plugin (contact-form-lite) prior to version 1.1.29 [ref_id=1].
What the fix does
The advisory states the fix is included in version 1.1.29 of the Contact Form Lite plugin [ref_id=1]. No patch diff is provided in the bundle, but the remediation involves properly sanitizing and escaping the plugin's settings before output to prevent stored XSS. Users should update to version 1.1.29 or later.
Preconditions
- authAttacker must have a WordPress account with at least Contributor-level privileges
- configThe Contact Form Lite plugin must be installed and active with a version prior to 1.1.29
Reproduction
The advisory links to a proof of concept at https://wpscan.com/vulnerability/e1e7f423-f981-413c-a99a-e5927fc1cd0c/ but does not include the reproduction steps in the extracted text [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- wpscan.com/vulnerability/e1e7f423-f981-413c-a99a-e5927fc1cd0c/mitreexploitvdb-entrytechnical-description
News mentions
0No linked articles in our index yet.