The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Booking Sms Plugin | — | Update booking-sms plugin to version 1.1.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Clockwork Two Factor Authentication Plugin | — | Update clockwork-two-factor-authentication plugin to version 1.1.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Contact Form 7 Sms Addon Plugin | — | Update contact-form-7-sms-addon plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Formidable Sms Plugin | — | Update formidable-sms plugin to version 1.1.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Fscf Sms Plugin | — | Update fscf-sms plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Gravity Forms Sms Notifications Plugin | — | Update gravity-forms-sms-notifications plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Mediaburst Ecommerce Sms Notifications Plugin | — | Update mediaburst-ecommerce-sms-notifications plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub