Unscored severity · published Sep 16, 2015
CVE-2015-6965
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication…
–
CVSS
3%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) create a field, (2) update a field, (3) delete a field, (4) create a form, (5) update a form, (6) delete a form, (7) create a template, (8) update a template, (9) delete a template, or (10) conduct cross-site scripting (XSS) attacks via a crafted request to the cfg_forms page in wp-admin/admin.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Contact Form Generator · Creative-solutions
through 2.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6965
packetstormsecurity.com
http://packetstormsecurity.com/files/133463/WordPress-Contact-Form-Generator-2.0.1-CSRF.html
wpvulndb.com
https://wpvulndb.com/vulnerabilities/8176
Exploit
https://www.exploit-db.com/exploits/38086/
More from Contact Form Generator
9.8
CVE-2023-35911
WordPress Contact Form Generator Plugin <= 2.6.0 is vulnerable to SQL Injection
6.1
CVE-2023-37988
WordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)