{"id":4019650,"date":"2013-08-12T06:52:14","date_gmt":"2013-08-12T06:52:14","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/security-issue-29\/"},"modified":"2016-08-21T03:50:59","modified_gmt":"2016-08-21T03:50:59","slug":"security-issue-29","status":"closed","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/security-issue-29\/","title":{"rendered":"Security issue"},"content":{"rendered":"<p>It seems the latest version is vulnerable to XSS attack.<br \/>\nTo reproduce <\/p>\n<p>1: go to http:\/\/site.com\/contact-us\/ (tested on http:\/\/bestwebsoft.com\/contacts\/contact-us\/ and it works as well)<br \/>\n2: put xss payload in any form<br \/>\n3: submit it with incomplete form (e.g invalid captcha)<br \/>\n4: payload used xxx&#8221;&lt;&gt;\/**\/onmouseover=confirm(1)&lt;&gt;\/**\/;\/\/<\/p>\n<p>https:\/\/wordpress.org\/plugins\/contact-form-plugin\/<\/p>\n","protected":false},"template":"","class_list":["post-4019650","topic","type-topic","status-closed","hentry","topic-tag-xss"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4019650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/4019650\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=4019650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}