The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Booking Sms Plugin | — | Update booking-sms plugin to version 1.1.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Clockwork Two Factor Authentication Plugin | — | Update clockwork-two-factor-authentication plugin to version 1.1.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Contact Form 7 Sms Addon Plugin | — | Update contact-form-7-sms-addon plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Formidable Sms Plugin | — | Update formidable-sms plugin to version 1.1.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Fscf Sms Plugin | — | Update fscf-sms plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Gravity Forms Sms Notifications Plugin | — | Update gravity-forms-sms-notifications plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
| Mediaburst Ecommerce Sms Notifications Plugin | — | Update mediaburst-ecommerce-sms-notifications plugin to version 2.4.1, or a newer patched version | May 15, 2025 | Dec 18, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub