CVE-2020-11516 in Contact Form 7 Datepicker Plugin
Summary
by MITRE
Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/09/2025
The vulnerability CVE-2020-11516 represents a critical stored cross-site scripting flaw within the Contact Form 7 Datepicker plugin for WordPress, affecting versions through 2.6.0. This security weakness stems from inadequate input validation and sanitization within the plugin's administrative interface, specifically in the wp_ajax_cf7dp_save_settings AJAX endpoint. The vulnerability allows authenticated attackers with minimal privileges to inject malicious JavaScript code into the plugin's configuration settings through the ui_theme parameter, creating a persistent security risk that can compromise administrator sessions.
The technical exploitation of this vulnerability occurs through the unprotected AJAX action wp_ajax_cf7dp_save_settings which lacks proper authentication checks and input sanitization. When an attacker with minimal permissions accesses the plugin's settings page and submits malicious JavaScript code via the ui_theme parameter, this code is stored in the WordPress database within the plugin's configuration. The vulnerability is classified as CWE-79 - Cross-site Scripting, which is a fundamental web application security flaw that enables attackers to inject client-side scripts into web pages viewed by other users. The attack vector specifically aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript, as it leverages JavaScript execution within the victim's browser context.
The operational impact of this vulnerability is severe as it enables attackers to escalate privileges and gain administrative control over WordPress installations. When administrators visit pages where the stored JavaScript is executed, typically during contact form creation or modification processes, the malicious code runs in their browser session with full administrative privileges. This allows attackers to perform actions such as creating new administrative user accounts, modifying existing user permissions, accessing sensitive data, and potentially exfiltrating information from the WordPress installation. The vulnerability essentially transforms any authenticated user with access to the plugin settings into a potential threat actor capable of compromising the entire WordPress environment.
Mitigation strategies for CVE-2020-11516 should focus on immediate remediation and long-term security hardening measures. The primary recommendation is to upgrade to the patched version of the Contact Form 7 Datepicker plugin, as the vulnerability was addressed through proper input validation and authentication checks. Organizations should also implement additional security measures including regular security audits of WordPress plugins, implementing proper access controls to limit administrative privileges, and deploying web application firewalls to detect and block malicious AJAX requests. The vulnerability demonstrates the importance of securing all administrative endpoints and validating all user inputs, regardless of the user's privilege level, as outlined in security best practices for web application development and the OWASP Top Ten security risks.