CVE-2015-4010

Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.

• CWE-352

• http://marc.info/?l=bugtraq&m=142607790919348&w=2Third Party Advisory
• http://packetstormsecurity.com/files/132209/WordPress-Encrypted-Contact-Form-1.0.4-CSRF-XSS.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/May/63Exploit, Mailing List, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/535699/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/73433Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/1125443/Release Notes
• https://wordpress.org/plugins/encrypted-contact-form/changelog/Patch, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/7992Third Party Advisory
• https://www.exploit-db.com/exploits/37264/Exploit, Third Party Advisory, VDB Entry
• http://marc.info/?l=bugtraq&m=142607790919348&w=2Third Party Advisory
• http://packetstormsecurity.com/files/132209/WordPress-Encrypted-Contact-Form-1.0.4-CSRF-XSS.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/May/63Exploit, Mailing List, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/535699/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/73433Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset/1125443/Release Notes
• https://wordpress.org/plugins/encrypted-contact-form/changelog/Patch, Third Party Advisory
• https://wpvulndb.com/vulnerabilities/7992Third Party Advisory
• https://www.exploit-db.com/exploits/37264/Exploit, Third Party Advisory, VDB Entry

Published

Jun 9, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3999Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the f…
• CVE-2015-4000The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersu…3.7
• CVE-2015-4001Integer signedness error in the oz_hcd_get_desc_cnf function…
• CVE-2015-4002drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in t…
• CVE-2015-4003The oz_usb_handle_ep_data function in drivers/staging/ozwpan…
• CVE-2015-4004The OZWPAN driver in the Linux kernel through 4.0.5 relies o…
• CVE-2015-4016The client detection protocol in Valve Steam allows remote a…
• CVE-2015-4017Salt before 2014.7.6 does not verify certificates when conne…
• CVE-2015-4018SQL injection vulnerability in feedwordpresssyndicationpage.…
• CVE-2015-4020RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x …
• CVE-2015-4021The phar_parse_tarfile function in ext/phar/tar.c in PHP bef…
• CVE-2015-4022Integer overflow in the ftp_genlist function in ext/ftp/ftp.…