Contact Form 7 blocks the word “Date” from being sent

Resolved ventio
(@ventio)

1 year, 7 months ago

I noticed that your plugin blocks sending the Contact Form 7 form when someone enters the word “Data” in textarena. How can I unlock this word?

Viewing 7 replies - 1 through 7 (of 7 total)

wfjoshc
(@wfjoshc)

1 year, 7 months ago

Hi @ventio
Thanks for reaching out!

Can you please send us the screenshot from Wordfence Live traffic of this word being blocked?

Thanks,

Joshua

Thread Starter ventio
(@ventio)

1 year, 7 months ago

screen: https://drive.google.com/file/d/1v9tiY3qD5jzCdV3WpO6fNO11RwwFxcTB/view?usp=share_link

wfjoshc
(@wfjoshc)

1 year, 7 months ago

Hi @ventio

It looks like its actually getting blocked for being an alleged Cross Site Scripting attack.

Are these users uploading any files?

Please let me know!

Thanks,

Joshua

Thread Starter ventio
(@ventio)

1 year, 7 months ago

they can upload files but that only happens when they use the “Data” text.
“Data” in Polish means date, so it’s a pretty common word.
How can I fix the problem?

wfjoshc
(@wfjoshc)

1 year, 7 months ago

Hi @ventio

You can disable XSS (Cross-Site Scripting) and this will stop this from being blocked!

I hope this helps!

Thanks,

Joshua

Thread Starter ventio
(@ventio)

1 year, 7 months ago

yes it helps. However, I’m afraid that disabling this feature will make my site vulnerable to other XSS attacks. Is there any other solution? Is it possible to enter an exclusion for this particular case?

wfjoshc
(@wfjoshc)

1 year, 7 months ago

Hi @ventio

Due to how form submission plugins work, and how we check for XSS attacks, its not possible to keep it enabled and not have this happen.

You can only allowlist IP addresses and not phrases.

I hope this helps to clarify.

Thanks,

Joshua

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Contact Form 7 blocks the word “Date” from being sent’ is closed to new replies.