CVE-2019-25145

Name of the Vulnerable Software and Affected Versions Contact Form & SMTP Plugin by PirateForms versions up to, and including, 2.5.1

Description The issue arises from insufficient input sanitization and output escaping in the 'public/class-pirateforms-public.php' file, allowing unauthenticated attackers to inject arbitrary HTML in emails. This could be used to phish unsuspecting victims.

Recommendations For versions up to, and including, 2.5.1, update to a version higher than 2.5.1 to resolve the issue. As a temporary workaround, consider restricting access to the 'public/class-pirateforms-public.php' file until a patch is available.