Contact Form 7
Cross Site Scripting Warning on Contact 7 Form (6 posts)

  1. SunSourceSolarBroker
    Posted 3 years ago #


    Can anyone advicse me with this issue? Below in the "NOTES" is the response that GoDaddy gave to me regarding cross scripting security risk to my website. They say it likely has to do with my WordPress Plugin for the Contact Form. They say that the plugin may have a security issue and needs to be updated or changed to a plugin with built in security for the cross scripting prevention. Thank you for your help.

    Notes from GoDaddy to me:

    At this time, it does appear that your site is vulnerable to Cross-Site Scripting.

    You can see this by inserting this URL into your browser:


    In order to prevent this type of attack you will need to ensure that untrusted data is kept separate from browser content. The following is recommended:

    1. The best option is to properly escape all untrusted data based on the HTML context (body, attribute, JavaScript, CSS, or URL) that the data will be placed into. Unless your UI framework does this for you, your developers will need to include this escaping in your application.

    2. The use of positive or "whitelist" input validation with appropriate canonicalization (decoding) can also help to protect against XSS. Please note that this is not a complete defense as many applications will require special characters in their input.

    Additionally you can visit the site below for more information on preventing Cross Site Scripting.



  2. SunSourceSolarBroker
    Posted 3 years ago #

    p.s. I regularly update this plugin and have had it for two years.

  3. Takayuki Miyoshi
    Plugin Author

    Posted 3 years ago #

    I couldn't confirm the vulnerability issue with the URL written in the note. Could you?

    This kind of vulnerability has not been reported from other users of the current version of the plugin.

  4. SunSourceSolarBroker
    Posted 3 years ago #

    Thank you for your kind reply. I'll call GoDaddy tomorrow to confirm whether the vulnerability is specific to the Contact Form or the Widget, as well as the URL confirmation. If you prefer, I can paste(into this blog) a portion of the cross scripting test that GoDaddy performed. However, I do not know the etiquette for placing that kind of information here. I do not want do something inappropriate... (I'm new to this). So I would rather wait for your direction. Would it be better if I emailed the GoDaddy test to you directly in an attachment? Thank you for your patience with me.

  5. Takayuki Miyoshi
    Plugin Author

    Posted 3 years ago #

    Testing on your blog is not necessary for now. Tell me the information from GoDaddy, please.

  6. latte62
    Posted 2 years ago #

    Greetings—I am being asked by my manager is this plugin is safe from Cross Site Scripting.

    Can you tell me if the outcome of the issue on this question from above?

    or is there a way a test for this condition. I really love this plugin and want to be able to continue to use it.

Topic Closed

This topic has been closed to new replies.

About this Plugin

  • Contact Form 7
  • Frequently Asked Questions
  • Support Threads
  • Reviews

About this Topic