CVE-2021-25080: Crmperks Contact Form Entries

Medium severity, CVSS 6.1. EPSS: 84.2% chance of exploitation in the next 30 days.

The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry

Affected products

• Crmperks Contact Form Entries: before 1.1.7 (fixed in 1.1.7)

Published 2022-01-24. Last modified 2026-06-17.