CVE-2015-9233

High

Published: 30/09/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The cp-contact-form-with-paypal plugin before version 1.1.6 for WordPress has a CSRF vulnerability that results in XSS. The issue is related to the files cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.

Risk Assessment

Exploitation of this vulnerability may lead to session hijacking or injection of malicious scripts, posing a threat to user data security.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and conduct a security audit of the application.

Other vulnerabilities in cp-contact-form-with-paypal plugin for WordPress

CVE-2015-9234High
The cp-contact-form-with-paypal plugin before version 1.1.6 for WordPress has an SQL injection vulnerability via the cp_contactformpp_id parameter in cp_contactformpp.php.

Original NVD description (English source)

The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS