Contact Form 7 Datepicker - High Vulnerability Leads To Plugin Closure

[ianscott]

On April 1, 2020, the Wordfence Threat Intelligence team discovered a stored Cross Site Scripting (XSS) vulnerability in Contact Form 7 Datepicker, a WordPress plugin installed on over 100,000 sites.

Read More.

 

[djbaxter]

Note this is just the datepicker addon, not the contact form itself.

See

https://securityaffairs.co/wordpress/100972/hacking/contact-form-7-datepicker-plugin-hack.html