WordPress Contact Form Builder Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the WordPress Contact Form Builder plugin, specifically in version 1.6.1. This vulnerability allows unauthenticated attackers to inject malicious scripts by exploiting the form_id parameter. Attackers can create harmful URLs directed to code_generator.php, embedding script payloads in the form_id parameter, which then execute arbitrary JavaScript in the browsers of affected users.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to code_generator.php with a form_id parameter that includes a script payload, such as a JavaScript alert. The injected script will be executed in the browser, demonstrating the cross-site scripting vulnerability.