What’s Vulnerable › Vulnerabilities

CVE-2021-24159: Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-05 · updated 2026-06-17
• Weakness: CWE-352

Description

Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.

Affected products

• rocklobsterinc Contact Form 7: through 3.1.9

References

• https://wpscan.com/vulnerability/363182f1-9fda-4363-8f6a-be37c4c07aa9
• https://www.wordfence.com/blog/2021/02/unpatched-vulnerability-50000-wp-sites-must-find-alternative-for-contact-form-7-style/
• https://wpscan.com/vulnerability/363182f1-9fda-4363-8f6a-be37c4c07aa9
• https://www.wordfence.com/blog/2021/02/unpatched-vulnerability-50000-wp-sites-must-find-alternative-for-contact-form-7-style/

Get alerted when CVE-2021-24159 or the next vulnerability affects your stack