Form2Email Contact Form to Email 1.3.24 form name cross site scripting

Summaryinfo

A vulnerability has been found in Form2Email Contact Form to Email 1.3.24 and classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument form name results in cross site scripting. This vulnerability is known as CVE-2021-47926. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Form2Email Contact Form to Email 1.3.24. This affects an unknown part. The manipulation of the argument form name with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

Contact Form to Email 1.3.24 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating forms with script tags in the form name field. Attackers can craft form names containing JavaScript code that executes when other logged-in users access the form management page, enabling session hijacking or credential theft.

The weakness was published by Mohammed Aadhil Ashfaq as 50524. The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2021-47926 since 02/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (50524). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Form2Email

Name

• Contact Form to Email

Version

• 1.3.24

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion