Database for Contact Form 7, WPforms, Elementor forms Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-2030 | WordPress Plugin Vulnerability Report

Plugin Name: Database for Contact Form 7, WPforms, Elementor forms

Key Information:

  • Software Type: Plugin
  • Software Slug: contact-form-entries
  • Software Status: Active
  • Software Author: crmperks
  • Software Downloads: 537,257
  • Active Installs: 60,000
  • Last Updated: March 8, 2024
  • Patched Versions: 1.3.4
  • Affected Versions: <= 1.3.3

Vulnerability Details:

  • Name: Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-2030
  • CVSS Score: 6.4
  • Publicly Published: March 6, 2024
  • Researcher: Krzysztof Zając - CERT PL
  • Description: The plugin is found to be vulnerable to Stored Cross-Site Scripting (XSS) via its shortcode(s), due to inadequate input sanitization and output escaping for user-supplied attributes. This vulnerability enables authenticated users with contributor or higher permissions to insert harmful web scripts into web pages. These scripts are then executed whenever the affected page is accessed by a user.


The Database for Contact Form 7, WPforms, Elementor forms plugin harbors a critical vulnerability in versions up to and including 1.3.3, which permits Stored Cross-Site Scripting through the plugin's shortcodes. This vulnerability has been effectively resolved in the recently released version 1.3.4.

Detailed Overview:

This vulnerability was meticulously identified by researcher Krzysztof Zając from CERT PL, who discovered that the plugin failed to properly sanitize input from users, leading to a significant security risk. The flaw allows attackers with at least contributor-level access to embed malicious scripts in pages, which are then executed by unsuspecting users accessing these pages. The developers have since taken prompt action to eliminate this vulnerability, mitigating the associated risks.

Advice for Users:

  • Immediate Action: It is imperative for users to update to the patched version 1.3.4 immediately to protect their sites.
  • Check for Signs of Vulnerability: Website administrators should vigilantly monitor their sites for any unusual or unauthorized changes or activities.
  • Alternate Plugins: Although a patch is available, users may wish to explore alternative plugins that offer similar functionalities as an additional precaution.
  • Stay Updated: Regularly updating your WordPress plugins is essential to defending against known vulnerabilities and ensuring the security of your website.


The swift resolution of this vulnerability by the plugin's developers highlights the crucial role of regular software updates in maintaining site security. To secure WordPress installations against potential threats, users are strongly advised to upgrade to version 1.3.4 or later of the Database for Contact Form 7, WPforms, Elementor forms plugin.


In the digital age, the security of online platforms is paramount, especially for small business owners who leverage WordPress for their websites. The recent identification of a critical vulnerability in the Database for Contact Form 7, WPforms, Elementor forms plugin—marked by CVE-2024-2030—serves as a stark reminder of the ever-present cybersecurity threats. This plugin, integral to facilitating user interactions through contact forms, has been compromised, posing significant risks to websites and their users alike.

Plugin Overview:

The Database for Contact Form 7, WPforms, Elementor forms plugin is a widely-used WordPress plugin developed by crmperks, boasting over half a million downloads and 60,000 active installations. It serves as a backbone for storing and managing submissions from various form plugins, making it an essential tool for many website owners.

Vulnerability Insights:

CVE-2024-2030, identified by researcher Krzysztof Zając from CERT PL, is an Authenticated (Contributor+) Stored Cross-Site Scripting (XSS) vulnerability present in versions up to and including 1.3.3. This flaw stems from the plugin's inability to properly sanitize and escape user-supplied input within its shortcodes, allowing attackers with contributor-level access or higher to inject malicious scripts that execute when a user accesses an injected page.

Risks and Implications:

The exploitation of this vulnerability can lead to severe consequences, including unauthorized access to sensitive information, session hijacking, and the potential defacement of websites. For small business owners, such breaches can erode customer trust, damage reputations, and even result in financial losses.

Remediation Strategies:

To mitigate the risks posed by this vulnerability, users are urged to update the plugin to the patched version 1.3.4 immediately. Website administrators should also conduct thorough audits of their sites for any signs of compromise and consider employing alternative plugins with similar functionality as an additional precautionary measure.

Historical Context:

This is not the first time vulnerabilities have been discovered in this plugin, with eight previous instances reported since January 5, 2021. Each instance serves as a reminder of the dynamic nature of cybersecurity threats and the need for constant vigilance.

The Criticality of Vigilance:

For small business owners, the discovery of CVE-2024-2030 in a widely-used plugin underscores the importance of maintaining up-to-date security practices. In the fast-paced world of digital commerce, staying informed about potential vulnerabilities and promptly applying software updates are critical steps in safeguarding online assets. Leveraging resources such as managed WordPress hosting services and security plugins can alleviate some of the burdens of continuous monitoring, allowing business owners to focus on growth while ensuring the security of their digital footprint.

In conclusion, the landscape of cybersecurity is fraught with challenges, but by adopting proactive security measures and staying abreast of the latest developments, small business owners can fortify their WordPress websites against potential threats. The resolution of the CVE-2024-2030 vulnerability serves as a testament to the ongoing battle against digital threats and the collective responsibility of developers, website owners, and the cybersecurity community at large to foster a safer online environment.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Database for Contact Form 7, WPforms, Elementor forms Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode – CVE-2024-2030 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment