Threats tagged 'ghsa-vw93-qjx2-fxhw'

The Contact Form by Supsystic WordPress plugin versions before 1.11.1 contains a server-side template injection vulnerability. This flaw allows an administrator to inject executable template code via stored form-editor content, which is then executed whenever a visitor loads a page containing the form. As a result, arbitrary code execution on the server is possible, and unauthenticated visitors can potentially access sensitive server-side information such as authentication salts and database credentials.