Security readout for executives and security teams
Plain-English summary
This CVE affects a WordPress plugin that connects Contact Form 7 to Google Sheets. A reflected XSS flaw could let an attacker run browser-side script against an administrator if they can get that user to open a crafted request. The source bundle does not show active exploitation.
Executive priority
Prioritize this for WordPress sites where the plugin is installed, especially production sites with many administrators. It is not KEV-listed, but admin-targeted XSS can support account misuse or site changes if a privileged user is tricked.
Technical view
CF7 Google Sheets Connector before 5.0.2, and cf7-google-sheets-connector-pro through 5.0.2, fail to escape a parameter before placing it in an HTML attribute. This is CWE-79 reflected XSS, with potential impact focused on high-privilege WordPress users such as admins.
Likely exposure
Exposure is likely limited to WordPress sites using the named CF7 Google Sheets Connector plugins. Risk is higher where administrators are reachable by phishing or support workflows that could deliver crafted links. The provided data does not identify affected CPEs or a CVSS score.
Exploitation context
WPScan is listed as a technical reference and tagged with exploit, but the bundle does not state active exploitation and CISA KEV is false. Treat this as publicly documented and potentially reproducible, not confirmed exploited in the wild.
Researcher notes
The evidence is narrow: plugin name, version ranges, CWE-79, and a WPScan reference. No CVSS vector, vulnerable parameter name, affected CPEs, or confirmed fixed pro version are provided in the bundle. Avoid claiming active exploitation without stronger evidence.
Mitigation direction
- Update CF7 Google Sheets Connector to version 5.0.2 or later.
- For the pro plugin, check vendor guidance because the bundle lists through 5.0.2 as affected.
- Temporarily disable or remove the plugin if no fixed pro version is available.
- Limit administrator exposure to unsolicited links and untrusted support requests.
- Monitor WordPress admin activity for unusual changes after suspected exposure.
Validation and detection
- Inventory WordPress sites for CF7 Google Sheets Connector installations.
- Confirm the free plugin is not below version 5.0.2.
- Confirm whether cf7-google-sheets-connector-pro is installed through version 5.0.2.
- Review plugin changelogs or vendor advisories for fixed pro releases.
- Check admin audit logs for unexpected configuration or user changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-2320 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/f17ccbaa-2fcd-4f17-a4da-73f2bc8a4fe9CVE reference · exploit, vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.