The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. The issue primarily affects multi-site installations and those where unfiltered_html has been disabled.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.4 | CVE-2025-8783 |
Exploitation
To exploit this vulnerability, an attacker with administrator-level access can craft a malicious payload that is injected into the ‘title’ parameter of the Contact Manager plugin. When a user accesses the affected page, the injected script will execute in their browser, potentially leading to session hijacking or other malicious actions.
Affected Products
- Contact Manager plugin for WordPress: A plugin that allows users to manage contacts, which is vulnerable to XSS attacks due to improper input handling.
Mitigation
To mitigate this vulnerability, it is recommended to update the Contact Manager plugin to the latest version where the issue has been addressed. Additionally, ensuring proper input sanitization and output escaping can help prevent similar vulnerabilities in the future.