OpenPGP Form Encryption for WordPress

OpenPGP Form Encryption for WordPress has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for OpenPGP Form Encryption for WordPress has a vendor fix available, so running the current release closes it.

All of these findings were reported by Bob Matyas. OpenPGP Form Encryption for WordPress is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.9.31.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all OpenPGP Form Encryption for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2024-3919

OpenPGP Form Encryption for WordPress <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv1.5.1

OpenPGP Form Encryption for WordPress

arnesonium

Author

arnesonium

5.0(1)
100/100
Last Updated
2024-04-17 (2y ago)
Active Installs
30+
Downloads
6,577
Requires WP
4.0+
Requires PHP
0+
Tested up to
WP 4.9.31
Created
2014-12-01 (12y ago)

This plugin uses OpenPGP.js to provide public key encryption for a textarea. It is most useful for any kind of text area that will be submitted via email or over an unsecured network connection. The GitHub repository for this plugin is located at https://github.com/pymander/wordpress-openpgp Usage This plugin provides a simple shortcode which you can add to your forms. To use the shortcode, you must first upload your ASCII-armored public key to your blog’s media section. Note that the public key must reside on the same server as your blog. The cryptbutton shortcode takes the following arguments. keyid The media ID of your ASCII-armored public key. Either this or keyurl are required. keyurl The URL for your ASCII-armored public key. Either this argument or keyid are required. textarea Optional. The HTML ID for the textarea element to be encrypted. When this is omitted, the plugin will try to find the correct textarea automatically. class Optional. Specify additional CSS classes for the button element. text Optional. Specify the button text. This defaults to “Encrypt”. You can also use the shortcode as an open/close tag, and the contents will be used as the button text. Example This example uses the Jetpack for WordPress contact form. You can see an example of the output on my Contact page. The WordPress code looks something like this: [contact-form subject='ARNESONIUM CONTACT'] [contact-field label='Name' type='name' required='1'/] [contact-field label='Email' type='email' required='1'/] [contact-field label='Phone' type='text'/] [contact-field label='Comment' type='textarea' required='1'/] [cryptbutton keyid=42]Encrypt[/cryptbutton] [/contact-form] Line 6 displays the cryptbutton usage. Note that I changed some elements of this example to make things clearer. You will need to play with layout and CSS to get things looking nice. Contact Form 7 This plugin also adds a cryptbutton shortcode to Contact Form 7. Shortcodes use a slightly different syntax with CF7. All of the options are still available, but the example above would be used in a form like this: <p> [cryptbutton keyid:42 "Encrypt"] [submit "Send"] </p>

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C