CVE-2013-10022 (published 2023-04-05T13:15Z)

A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.

CVSS v3 base score: 6.1, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-79
cwe_name: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
extended_description: 
            Cross-site scripting (XSS) vulnerabilities occur when:
            
               Untrusted data enters a web application, typically from a web request.
               The web application dynamically generates a web page that contains this untrusted data.
               During page generation, the application does not prevent the data from containing content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes, mouse events, Flash, ActiveX, etc.
               A victim visits the generated web page through a web browser, which contains malicious script that was injected using the untrusted data.
               Since the script comes from a web page that was sent by the web server, the victim's web browser executes the malicious script in the context of the web server's domain.
               This effectively violates the intention of the web browser's same-origin policy, which states that scripts in one domain should not be able to access resources or run code in a different domain.
            
            There are three main kinds of XSS:
            
               
                  Type 1: Reflected XSS (or Non-Persistent) - 
         			The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.
               
                  Type 2: Stored XSS (or Persistent) - 
               The application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content. From an attacker's perspective, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. For example, the attacker might inject XSS into a log message, which might not be handled properly when an administrator views the logs.
            
               
                  Type 0: DOM-Based XSS - 
               In DOM-based XSS, the client performs the injection of XSS into the page; in the other types, the server performs the injection. DOM-based XSS generally involves server-controlled, trusted script that is sent to the client, such as Javascript that performs sanity checks on a form before the user submits it. If the server-supplied script processes user-supplied data and then injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is possible.
            
            
            Once the malicious script is injected, the attacker can perform a variety of malicious activities. The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site. Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site. Finally, the script could exploit a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes referred to as "drive-by hacking."
            In many cases, the attack can be launched without the victim even being aware of it. Even with careful users, attackers frequently use a variety of methods to encode the malicious portion of the attack, such as URL encoding or Unicode, so the request looks less suspicious.
         
         

Fix information:
repo_url: https://github.com/wp-plugins/contact-form-plugin
commit_details: repo_url: https://github.com/wp-plugins/contact-form-plugin
author: bestwebsoft
author_date: 2013-08-13 10:28:44+00:00
msg: V3.52 - The Japanese language file is updated. We fixed the bug related to XSS attack.

git-svn-id: https://plugins.svn.wordpress.org/contact-form-plugin/trunk@755567 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/contact-form-plugin
repo_name: wp-plugins/contact-form-plugin
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: contact_form.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Plugin Name: Contact Form Plugin
 Plugin URI:  http://bestwebsoft.com/plugin/
 Description: Plugin for Contact Form.
 Author: BestWebSoft
-Version: 3.51
+Version: 3.52
 Author URI: http://bestwebsoft.com/
 License: GPLv2 or later
 */
@@ -380,7 +380,7 @@ if( ! function_exists( 'cntctfrm_admin_menu' ) ) {
 // Register settings for plugin
 if( ! function_exists( 'cntctfrm_settings' ) ) {
 	function cntctfrm_settings() {
-		global $cntctfrm_options, $cntctfrm_option_defaults;
+		global $cntctfrm_options, $cntctfrm_option_defaults, $wpdb;
 
 		$cntctfrm_option_defaults = array(
 			'cntctfrm_user_email' => 'admin',
@@ -474,6 +474,31 @@ if( ! function_exists( 'cntctfrm_settings' ) ) {
 			$cntctfrm_options['cntctfrm_send_copy_label']['en'] = __( "Send me a copy", 'contact_form' );
 
 		update_option( 'cntctfrm_options', $cntctfrm_options );
+
+		// create db table of fields list
+		$sql = "CREATE TABLE IF NOT EXISTS `" . $wpdb->prefix . "cntctfrm_field` (
+			id int NOT NULL AUTO_INCREMENT,							
+			name CHAR(100) NOT NULL,
+			UNIQUE KEY id (id)
+		);";
+		require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
+		dbDelta( $sql );
+		$fields = array( 'display_address_field',
+			'display_phone_field',
+			'attachment',
+			'attachment_explanations',
+			'send_copy',
+			'display_sent_from',
+			'display_date_time',
+			'display_coming_from',
+			'display_user_agent'
+		);
+		foreach ( $fields as $key => $value ) {
+			$db_row = $wpdb->get_row( "SELECT * FROM " . $wpdb->prefix . "cntctfrm_field WHERE `name` = '" . $value . "'", ARRAY_A );
+			if ( !isset( $db_row ) || empty( $db_row ) ) {
+				$wpdb->insert(  $wpdb->prefix . "cntctfrm_field", array( 'name' => $value ), array( '%s' ) );	
+			}
+		}
 	}
 }
 
@@ -821,8 +846,6 @@ if( ! function_exists( 'cntctfrm_settings_page' ) ) {
 						<input type="checkbox" id="cntctfrm_display_address_field" name="cntctfrm_display_address_field" value="1" <?php if($cntctfrm_options['cntctfrm_display_address_field'] == '1') echo "checked=\"checked\" "; ?>/> <?php _e( "Address", 'contact_form' ); ?><br />
 						<input type="checkbox" id="cntctfrm_display_phone_field" name="cntctfrm_display_phone_field" value="1" <?php if($cntctfrm_options['cntctfrm_display_phone_field'] == '1') echo "checked=\"checked\" "; ?>/> <?php _e( "Phone", 'contact_form' ); ?><br />
 						<input type="checkbox" id="cntctfrm_attachment" name="cntctfrm_attachment" value="1" <?php if($cntctfrm_options['cntctfrm_attachment'] == '1') echo "checked=\"checked\" "; ?>/> <?php _e( "Attachment block", 'contact_form' ); ?> <span  class="cntctfrm_info">(<?php echo __( "Users can attach the following file formats", 'contact_form' ) . ": html, txt, css, gif, png, jpeg, jpg, tiff, bmp, ai, eps, ps, rtf, pdf, doc, docx, xls, zip, rar, wav, mp3, ppt"; ?>)</span><br />
-						<input type="checkbox" id="cntctfrm_attachment_explanations" name="cntctfrm_attachment_explanations" value="1" <?php if( $cntctfrm_options['cntctfrm_attachment_explanations'] == '1' && $cntctfrm_options['cntctfrm_attachment'] == '1' ) echo "checked=\"checked\" "; ?>/> <?php echo __( "Tips below the Attachment block", 'contact_form' ); ?><br />
-						<input type="checkbox" id="cntctfrm_send_copy" name="cntctfrm_send_copy" value="1" <?php if($cntctfrm_options['cntctfrm_send_copy'] == '1') echo "checked=\"checked\" "; ?>/> <?php _e( "Send me a copy block", 'contact_form' ); ?> <br />
 						<?php $all_plugins = get_plugins();
 						if ( is_multisite() ) {
 							$active_plugins = (array) array_keys( get_site_option( 'active_sitewide_plugins', array() ) );
@@ -844,6 +867,18 @@ if( ! function_exists( 'cntctfrm_settings_page' ) ) {
 						<?php } ?>
 					</td>
 				</tr>
+				<tr valign="top" class="cntctfrm_additions_block <?php if($cntctfrm_options['cntctfrm_additions_options'] == '0') echo "cntctfrm_hidden"; ?>">
+					<th scope="row" style="width:200px;"><?php echo __( "Display tips below the Attachment block", 'contact_form' ); ?></th>
+					<td colspan="2">
+						<input type="checkbox" id="cntctfrm_attachment_explanations" name="cntctfrm_attachment_explanations" value="1" <?php if( $cntctfrm_options['cntctfrm_attachment_explanations'] == '1' && $cntctfrm_options['cntctfrm_attachment'] == '1' ) echo "checked=\"checked\" "; ?>/>
+					</td>
+				</tr>
+				<tr valign="top" class="cntctfrm_additions_block <?php if($cntctfrm_options['cntctfrm_additions_options'] == '0') echo "cntctfrm_hidden"; ?>">
+					<th scope="row" style="width:200px;"><?php _e( "Display 'Send me a copy' block", 'contact_form' ); ?> </th>
+					<td colspan="2">
+						<input type="checkbox" id="cntctfrm_send_copy" name="cntctfrm_send_copy" value="1" <?php if($cntctfrm_options['cntctfrm_send_copy'] == '1') echo "checked=\"checked\" "; ?>/>
+					</td>
+				</tr>
 				<tr valign="top" class="cntctfrm_additions_block <?php if($cntctfrm_options['cntctfrm_additions_options'] == '0') echo "cntctfrm_hidden"; ?>">
 					<th scope="row" style="width:200px;"><?php _e( "Required fields", 'contact_form' ); ?></th>
 					<td colspan="2">
@@ -1286,12 +1321,12 @@ if( ! function_exists( 'cntctfrm_display_form' ) ) {
             $page_url = ( isset( $_SERVER["HTTPS"] ) && $_SERVER["HTTPS"] == "on" ? "https://" : "http://" ).$_SERVER["SERVER_NAME"].strip_tags( $_SERVER["REQUEST_URI"] );
 
 		// If contact form submited
-		$name = isset( $_POST['cntctfrm_contact_name'] ) ? $_POST['cntctfrm_contact_name'] : "";
-		$address = isset( $_POST['cntctfrm_contact_address'] ) ? $_POST['cntctfrm_contact_address'] : "";
-		$email = isset( $_POST['cntctfrm_contact_email'] ) ? stripslashes( $_POST['cntctfrm_contact_email'] ) : "";
-		$subject = isset( $_POST['cntctfrm_contact_subject'] ) ? $_POST['cntctfrm_contact_subject'] : "";
-		$message = isset( $_POST['cntctfrm_contact_message'] ) ? $_POST['cntctfrm_contact_message'] : "";
-		$phone = isset( $_POST['cntctfrm_contact_phone'] ) ? $_POST['cntctfrm_contact_phone'] : "";
+		$name = isset( $_POST['cntctfrm_contact_name'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_name'] ) : "";
+		$address = isset( $_POST['cntctfrm_contact_address'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_address'] ) : "";
+		$email = isset( $_POST['cntctfrm_contact_email'] ) ? htmlspecialchars( stripslashes( $_POST['cntctfrm_contact_email'] ) ) : "";
+		$subject = isset( $_POST['cntctfrm_contact_subject'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_subject'] ) : "";
+		$message = isset( $_POST['cntctfrm_contact_message'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_message'] ) : "";
+		$phone = isset( $_POST['cntctfrm_contact_phone'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_phone'] ) : "";
 
 		$name = strip_tags( preg_replace ( '/<[^>]*>/', '', preg_replace ( '/<script.*<\/[^>]*>/', '', $name ) ) );
 		$address = strip_tags( preg_replace ( '/<[^>]*>/', '', preg_replace ( '/<script.*<\/[^>]*>/', '', $address ) ) );
@@ -1456,12 +1491,12 @@ if( ! function_exists( 'cntctfrm_check_form' ) ) {
 		// Error messages array
 		$error_message = array();
 
-		$name = isset( $_POST['cntctfrm_contact_name'] ) ? $_POST['cntctfrm_contact_name'] : "";
-		$address = isset( $_POST['cntctfrm_contact_address'] ) ? $_POST['cntctfrm_contact_address'] : "";
-		$email = isset( $_POST['cntctfrm_contact_email'] ) ? stripslashes( $_POST['cntctfrm_contact_email'] ) : "";
-		$subject = isset( $_POST['cntctfrm_contact_subject'] ) ? $_POST['cntctfrm_contact_subject'] : "";
-		$message = isset( $_POST['cntctfrm_contact_message'] ) ? $_POST['cntctfrm_contact_message'] : "";
-		$phone = isset( $_POST['cntctfrm_contact_phone'] ) ? $_POST['cntctfrm_contact_phone'] : "";
+		$name = isset( $_POST['cntctfrm_contact_name'] ) ?  htmlspecialchars( $_POST['cntctfrm_contact_name'] ) : "";
+		$address = isset( $_POST['cntctfrm_contact_address'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_address'] ) : "";
+		$email = isset( $_POST['cntctfrm_contact_email'] ) ? htmlspecialchars( stripslashes( $_POST['cntctfrm_contact_email'] ) ) : "";
+		$subject = isset( $_POST['cntctfrm_contact_subject'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_subject'] ) : "";
+		$message = isset( $_POST['cntctfrm_contact_message'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_message'] ) : "";
+		$phone = isset( $_POST['cntctfrm_contact_phone'] ) ? htmlspecialchars( $_POST['cntctfrm_contact_phone'] ) : "";
 
 		$name = strip_tags( preg_replace ( '/<[^>]*>/', '', preg_replace ( '/<script.*<\/[^>]*>/', '', $name ) ) ); 
 		$address = strip_tags( preg_replace ( '/<[^>]*>/', '', preg_replace ( '/<script.*<\/[^>]*>/', '', $address ) ) ); 

programming_language: PHP
filename: contact_form-ja.po
change_type: ModificationType.MODIFY
diff: @@ -2,10 +2,10 @@ msgid ""
 msgstr ""
 "Project-Id-Version: contact_form\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2013-07-29 17:32+0300\n"
-"PO-Revision-Date: 2013-07-29 17:33+0300\n"
+"POT-Creation-Date: 2013-08-13 12:33+0300\n"
+"PO-Revision-Date: 2013-08-13 12:33+0300\n"
 "Last-Translator: \n"
-"Language-Team: Thomas Hartung <thartung@adipositas-mm.de>\n"
+"Language-Team: foken <foken@gmx.com>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
@@ -13,22 +13,22 @@ msgstr ""
 "X-Poedit-KeywordsList: __;_e\n"
 "X-Poedit-Basepath: ..\n"
 "X-Poedit-SourceCharset: utf-8\n"
-"X-Generator: Poedit 1.5.4\n"
+"X-Generator: Poedit 1.5.7\n"
 "X-Poedit-SearchPath-0: .\n"
 
 #: contact_form.php:106
 msgid "Not set"
-msgstr ""
+msgstr "未設定"
 
 #: contact_form.php:108
 #: contact_form.php:112
 msgid "On"
-msgstr ""
+msgstr "On"
 
 #: contact_form.php:110
 #: contact_form.php:114
 msgid "Off"
-msgstr ""
+msgstr "Off"
 
 #: contact_form.php:118
 #: contact_form.php:122
@@ -37,120 +37,117 @@ msgstr ""
 #: contact_form.php:134
 #: contact_form.php:160
 msgid "N/A"
-msgstr ""
+msgstr "該当なし"
 
 #: contact_form.php:132
 msgid " Mb"
-msgstr ""
+msgstr " Mb"
 
 #: contact_form.php:136
 #: contact_form.php:140
 #: contact_form.php:144
 #: contact_form.php:155
 msgid "Yes"
-msgstr ""
+msgstr "はい"
 
 #: contact_form.php:138
 #: contact_form.php:142
 #: contact_form.php:146
 #: contact_form.php:157
 msgid "No"
-msgstr ""
+msgstr "いいえ"
 
 #: contact_form.php:171
 msgid "Operating System"
-msgstr ""
+msgstr "オペレーション・システム"
 
 #: contact_form.php:172
 msgid "Server"
-msgstr ""
+msgstr "サーバ"
 
 #: contact_form.php:173
-#, fuzzy
 msgid "Memory usage"
-msgstr "メッセージ"
+msgstr "メモリー使用"
 
 #: contact_form.php:174
 msgid "MYSQL Version"
-msgstr ""
+msgstr "MYSQL バージョン"
 
 #: contact_form.php:175
 msgid "SQL Mode"
-msgstr ""
+msgstr "SQLモード"
 
 #: contact_form.php:176
 msgid "PHP Version"
-msgstr ""
+msgstr "PHP バージョン"
 
 #: contact_form.php:177
 msgid "PHP Safe Mode"
-msgstr ""
+msgstr "PHP Safe Mode"
 
 #: contact_form.php:178
 msgid "PHP Allow URL fopen"
-msgstr ""
+msgstr "PHP Allow URL fopen"
 
 #: contact_form.php:179
 msgid "PHP Memory Limit"
-msgstr ""
+msgstr "PHP Memory Limit"
 
 #: contact_form.php:180
 msgid "PHP Max Upload Size"
-msgstr ""
+msgstr "PHP Max Upload Size"
 
 #: contact_form.php:181
 msgid "PHP Max Post Size"
-msgstr ""
+msgstr "PHP Max Post Size"
 
 #: contact_form.php:182
 msgid "PHP Max Script Execute Time"
-msgstr ""
+msgstr "PHP Max Script Execute Time"
 
 #: contact_form.php:183
 msgid "PHP Exif support"
-msgstr ""
+msgstr "PHP Exif サポート"
 
 #: contact_form.php:184
 msgid "PHP IPTC support"
-msgstr ""
+msgstr "PHP IPTC サポート"
 
 #: contact_form.php:185
 msgid "PHP XML support"
-msgstr ""
+msgstr "PHP XML サポート"
 
 #: contact_form.php:186
-#, fuzzy
 msgid "Site URL"
-msgstr "サイト"
+msgstr "サイトURL"
 
 #: contact_form.php:187
 msgid "Home URL"
-msgstr ""
+msgstr "ホームURL"
 
 #: contact_form.php:188
 msgid "WordPress Version"
-msgstr ""
+msgstr "WordPress バージョン"
 
 #: contact_form.php:189
 msgid "WordPress DB Version"
-msgstr ""
+msgstr "WordPress データベース バージョン"
 
 #: contact_form.php:190
 msgid "Multisite"
-msgstr ""
+msgstr "複数サイト"
 
 #: contact_form.php:191
 msgid "Active Theme"
-msgstr ""
+msgstr "有効なテーマ"
 
 #: contact_form.php:206
-#, fuzzy
 msgid "Please enter a valid email address."
-msgstr "このemailを利用:"
+msgstr "正確なEメール・アドレスを入力して下さい。"
 
 #: contact_form.php:210
 msgid "Email with system info is sent to "
-msgstr ""
+msgstr "システム情報をメールで送信:"
 
 #: contact_form.php:214
 #: contact_form.php:434
@@ -163,9 +160,8 @@ msgid "Sorry, email message could not be delivered."
 msgstr "申し訳ございませんが、貴方のemailは配信できませんでした。"
 
 #: contact_form.php:250
-#, fuzzy
 msgid "Pro plugins"
-msgstr "BWS Plugins"
+msgstr "Pro Plugins"
 
 #: contact_form.php:253
 #: contact_form.php:279
@@ -202,12 +198,11 @@ msgstr "推奨プラグイン"
 
 #: contact_form.php:271
 msgid "Purchase"
-msgstr ""
+msgstr "購入"
 
 #: contact_form.php:276
-#, fuzzy
 msgid "Free plugins"
-msgstr "推奨プラグイン"
+msgstr "無料プラグイン"
 
 #: contact_form.php:297
 msgid "Download"
@@ -223,57 +218,50 @@ msgid "Install now from wordpress.org"
 msgstr "wordpress.org から直ぐに導入"
 
 #: contact_form.php:302
-#, fuzzy
 msgid "If you have any questions, please contact us via"
-msgstr "もそご質問がある場合は、plugin@bestwebsoft.comにご連絡頂くか、我々のサイトのコンタクトフォームからお願いします。"
+msgstr "もそご質問がある場合は、以下の方法でご連絡下さい:"
 
 #: contact_form.php:309
 msgid "System status"
-msgstr ""
+msgstr "システム状況"
 
 #: contact_form.php:313
 msgid "Environment"
-msgstr ""
+msgstr "環境"
 
 #: contact_form.php:324
-#, fuzzy
 msgid "Active Plugins"
 msgstr "有効なプラグイン"
 
 #: contact_form.php:335
-#, fuzzy
 msgid "Inactive Plugins"
-msgstr "有効なプラグイン"
+msgstr "無効なプラグイン"
 
 #: contact_form.php:349
-#, fuzzy
 msgid "Send to support"
-msgstr "サポート"
+msgstr "サポートに送信"
 
 #: contact_form.php:356
 msgid "Send to custom email &#187;"
-msgstr ""
+msgstr "カスタムEメールに送信&#187;"
 
 #: contact_form.php:372
 #: contact_form.php:750
-#, fuzzy
 msgid "Contact Form Settings"
-msgstr "コンタクトフォーム オプション"
+msgstr "コンタクトフォーム設定"
 
 #: contact_form.php:372
 msgid "Contact Form"
-msgstr "Contact Form"
+msgstr "コンタクトフォーム"
 
 #: contact_form.php:373
-#, fuzzy
 msgid "Contact Form Pro Extra Settings"
-msgstr "コンタクトフォーム オプション"
+msgstr "Contact Form Pro 用設定"
 
 #: contact_form.php:373
 #: contact_form.php:1010
-#, fuzzy
 msgid "Contact Form Pro"
-msgstr "Contact Form"
+msgstr "Contact Form Pro"
 
 #: contact_form.php:412
 #: contact_form.php:899
@@ -284,21 +272,20 @@ msgstr "名前:"
 #: contact_form.php:413
 #: contact_form.php:900
 #: contact_form.php:929
-#, fuzzy
 msgid "Address:"
-msgstr "E-Mail:"
+msgstr "住所:"
 
 #: contact_form.php:414
 #: contact_form.php:901
 #: contact_form.php:930
 msgid "Email Address:"
-msgstr "E-Mail:"
+msgstr "Eメール:"
 
 #: contact_form.php:415
 #: contact_form.php:902
 #: contact_form.php:931
 msgid "Phone number:"
-msgstr ""
+msgstr "電話番号:"
 
 #: contact_form.php:416
 #: contact_form.php:903
@@ -336,21 +323,18 @@ msgid "Your name is required."
 msgstr "名前は必須です。"
 
 #: contact_form.php:422
-#, fuzzy
 msgid "Address is required."
-msgstr "正確なemailが必須です。"
+msgstr "住所が必要です。"
 
 #: contact_form.php:423
-#, fuzzy
 msgid "A valid email address is required."
-msgstr "正確なemailが必須です。"
+msgstr "有効なEメールアドレスlが必須です。"
 
 #: contact_form.php:424
 #: contact_form.php:469
 #: contact_form.php:472
-#, fuzzy
 msgid "Phone number is required."
-msgstr "名前は必須です。"
+msgstr "電話番号は必須です。"
 
 #: contact_form.php:425
 #: contact_form.php:468
@@ -370,15 +354,15 @@ msgstr "添付が壊れています。"
 
 #: contact_form.php:428
 msgid "File upload error."
-msgstr ""
+msgstr "ファイル・アップロード・エラー。"
 
 #: contact_form.php:429
 msgid "The file could not be uploaded."
-msgstr ""
+msgstr "ファイルは、アップロード出来ませんでした。"
 
 #: contact_form.php:430
 msgid "This file is too large."
-msgstr ""
+msgstr "このファイルは大きすぎます。"
 
 #: contact_form.php:431
 msgid "Please fill out the CAPTCHA."
@@ -390,7 +374,7 @@ msgstr "以下を修正し、再度試して下さい。"
 
 #: contact_form.php:705
 msgid "If the 'Redirect to page' option is selected then the URL field should be in the following format"
-msgstr ""
+msgstr "’ページに転送’オプションを選択した場合は、URLフィールドが、以下の形式になります"
 
 #: contact_form.php:714
 msgid "Such user does not exist. Settings are not saved."
@@ -398,41 +382,37 @@ msgstr "このようなユーザは存在しません。設定は保存されま
 
 #: contact_form.php:719
 #: contact_form.php:725
-#, fuzzy
 msgid "Please enter a valid email address in the 'FROM' field. Settings are not saved."
-msgstr "正確なemailを入力して下さい。設定は保存されません。"
+msgstr "'送信者'フィールドに正確なEメール・アドレスを入力して下さい。設定は保存されません。"
 
 #: contact_form.php:730
-#, fuzzy
 msgid "Settings saved."
-msgstr "オプション保存."
+msgstr "設定保存."
 
 #: contact_form.php:755
 #: contact_form.php:1005
-#, fuzzy
 msgid "Extra settings"
-msgstr "設定"
+msgstr "追加設定"
 
 #: contact_form.php:760
 #: contact_form.php:1261
-#, fuzzy
 msgid "If you would like to add the Contact Form to your website, just copy and paste this shortcode to your post or page or widget:"
-msgstr "コンタクトフォームをあなたのサイトに追加したい場合は、このショートカットを投稿またはページにコピーして貼り付けるだけです。"
+msgstr "コンタクトフォームをあなたのサイトに追加したい場合は、このショートカットを投稿、ページ又はウェジットにコピーして貼り付けるだけです:"
 
 #: contact_form.php:760
 #: contact_form.php:761
 #: contact_form.php:921
 #: contact_form.php:969
 msgid "or"
-msgstr ""
+msgstr "又は"
 
 #: contact_form.php:761
 msgid "If have any problems with the standard shortcode [contact_form], you should use the shortcode"
-msgstr ""
+msgstr "標準的な短いコード [contact_form]に問題がある場合は、この短いコードをご利用下さい"
 
 #: contact_form.php:762
 msgid "They work the same way."
-msgstr ""
+msgstr "同様に動作します。"
 
 #: contact_form.php:763
 msgid "If you leave the fields empty, the messages will be sent to the email address specified during registration."
@@ -447,9 +427,8 @@ msgid "Create a username"
 msgstr "ユーザ名の選択"
 
 #: contact_form.php:776
-#, fuzzy
 msgid "Enter a username of the person who should get the messages from the contact form."
-msgstr "コンタクトフォームからメッセージを受け取るユーザ名を設定。"
+msgstr "コンタクトフォームからメッセージを受け取る方のユーザ名を入力。"
 
 #: contact_form.php:780
 msgid "Use this email address:"
@@ -465,111 +444,102 @@ msgstr "追加オプション"
 
 #: contact_form.php:790
 msgid "What to use?"
-msgstr ""
+msgstr "何用途？"
 
 #: contact_form.php:793
-#, fuzzy
 msgid "Wp-mail"
-msgstr "E-Mail"
+msgstr "WPメール"
 
 #: contact_form.php:794
 msgid "You can use the wp_mail function for mailing"
-msgstr ""
+msgstr "メールにwp_mali機能が利用できます"
 
 #: contact_form.php:800
 msgid "Mail"
-msgstr ""
+msgstr "メール"
 
 #: contact_form.php:801
 msgid "To send mail you can use the php mail function"
-msgstr ""
+msgstr "メールを送信するには、phpメール機能が利用できます"
 
 #: contact_form.php:805
-#, fuzzy
 msgid "Change text of the 'FROM' field"
-msgstr "コンタクトフォームのフィールドのラベルを変更"
+msgstr "'送信者' フィールドのテキストを変更"
 
 #: contact_form.php:811
 msgid "Enter the email address in the 'From' field"
-msgstr ""
+msgstr "'送信者' フィールドにメールアドレスを入力して下さい"
 
 #: contact_form.php:813
 msgid "User email"
-msgstr ""
+msgstr "ユーザ・Eメール"
 
 #: contact_form.php:813
 msgid "The email address of the user who fills the form will be used in the field 'From'."
-msgstr ""
+msgstr "フォームを入力したユーザのEメール・アドレスは、'送信者'フィールドに使用されます。"
 
 #: contact_form.php:815
 msgid "This email address will be used in the 'From' field."
-msgstr ""
+msgstr "このEメール・アドレスは、'送信者'フィールドに使用されます。"
 
 #: contact_form.php:819
-#, fuzzy
 msgid "Display fields"
-msgstr "添付ブロックを表示"
+msgstr "フィールドを表示"
 
 #: contact_form.php:821
 #: contact_form.php:851
 #: contact_form.php:1041
 #: contact_form.php:1693
-#, fuzzy
 msgid "Address"
-msgstr "E-Mail:"
+msgstr "住所"
 
 #: contact_form.php:822
 #: contact_form.php:853
 #: contact_form.php:1701
 msgid "Phone"
-msgstr ""
+msgstr "電話"
 
 #: contact_form.php:823
-#, fuzzy
 msgid "Attachment block"
-msgstr "添付ブロックを表示"
+msgstr "添付ブロック"
 
 #: contact_form.php:823
 msgid "Users can attach the following file formats"
 msgstr "ユーザは、以下のタイプのファイルを添付できる"
 
 #: contact_form.php:824
-#, fuzzy
 msgid "Tips below the Attachment block"
-msgstr "添付ブロックを表示"
+msgstr "添付ブロックの下のチップス"
 
 #: contact_form.php:825
-#, fuzzy
 msgid "Send me a copy block"
-msgstr "コピーブロックを自分に送るを表示"
+msgstr "コピーブロックを自分に送る"
 
 #: contact_form.php:837
 #: contact_form.php:840
 #: contact_form.php:843
 #: contact_form.php:1070
 msgid "Captcha"
-msgstr ""
+msgstr "Captcha"
 
 #: contact_form.php:837
 #: contact_form.php:840
 #: contact_form.php:843
 #: contact_form.php:1070
 msgid "(powered by bestwebsoft.com)"
-msgstr ""
+msgstr "(powered by bestwebsoft.com)"
 
 #: contact_form.php:840
-#, fuzzy
 msgid "Activate captcha"
-msgstr "有効なプラグイン"
+msgstr "有効なcaptcha"
 
 #: contact_form.php:843
-#, fuzzy
 msgid "Download captcha"
-msgstr "ダウンロード"
+msgstr "captchaをダウンロード"
 
 #: contact_form.php:848
 msgid "Required fields"
-msgstr ""
+msgstr "必須フィールド"
 
 #: contact_form.php:850
 #: contact_form.php:1036
@@ -578,9 +548,8 @@ msgid "Name"
 msgstr "名前"
 
 #: contact_form.php:852
-#, fuzzy
 msgid "Email Address"
-msgstr "E-Mail:"
+msgstr "Eメール・アドレス"
 
 #: contact_form.php:854
 #: contact_form.php:1056
@@ -596,7 +565,7 @@ msgstr "メッセージ"
 
 #: contact_form.php:859
 msgid "Display additional info in the email"
-msgstr ""
+msgstr "メール中に追加情報を表示"
 
 #: contact_form.php:864
 #: contact_form.php:1660
@@ -620,117 +589,115 @@ msgstr "(user agent)使用"
 
 #: contact_form.php:871
 msgid "Language settings for the field names in the form"
-msgstr ""
+msgstr "フォームのフィールド名用の言語設定"
 
 #: contact_form.php:880
 msgid "Add a language"
-msgstr ""
+msgstr "言語の追加"
 
 #: contact_form.php:884
-#, fuzzy
 msgid "Change the names of the contact form fields and error messages"
-msgstr "コンタクトフォームのフィールドのラベルを変更"
+msgstr "コンタクト・フォームのフィールドの名前及びエラーメッセージを変更"
 
 #: contact_form.php:889
 #: contact_form.php:960
 msgid "English"
-msgstr ""
+msgstr "英語"
 
 #: contact_form.php:908
 #: contact_form.php:937
 msgid "Error message for the Name field"
-msgstr ""
+msgstr "名前フィールド用のエラーメッセージ"
 
 #: contact_form.php:909
 #: contact_form.php:938
 msgid "Error message for the Address field"
-msgstr ""
+msgstr "住所フィールド用のエラーメッセージ"
 
 #: contact_form.php:910
 #: contact_form.php:939
 msgid "Error message for the Email field"
-msgstr ""
+msgstr "Eメール・フィールド用のエラーメッセージ"
 
 #: contact_form.php:911
 #: contact_form.php:940
 msgid "Error message for the Phone field"
-msgstr ""
+msgstr "電話フィールド用のエラーメッセージ"
 
 #: contact_form.php:912
 #: contact_form.php:941
 msgid "Error message for the Subject field"
-msgstr ""
+msgstr "件名フィールド用のエラーメッセージ"
 
 #: contact_form.php:913
 #: contact_form.php:942
 msgid "Error message for the Message field"
-msgstr ""
+msgstr "メッセージ・フィールド用のエラーメッセージ"
 
 #: contact_form.php:914
 #: contact_form.php:943
 msgid "Error message about the file type for the Attachment field"
-msgstr ""
+msgstr "添付フィールド用の拡張子タイプに関するエラーメッセージ"
 
 #: contact_form.php:915
 #: contact_form.php:944
 msgid "Error message while uploading a file for the Attachment field to the server"
-msgstr ""
+msgstr "添付フィールド用のファイルをサーバにアップロード中のエラーメッセージ"
 
 #: contact_form.php:916
 #: contact_form.php:945
 msgid "Error message while moving the file for the Attachment field"
-msgstr ""
+msgstr "添付フィールド用のファイルを移動中のエラーメッセージ"
 
 #: contact_form.php:917
 #: contact_form.php:946
 msgid "Error message when file size limit for the Attachment field is exceeded"
-msgstr ""
+msgstr "添付フィールド用のファイルサイズ制限を超した場合のエラーメッセージ"
 
 #: contact_form.php:918
 #: contact_form.php:947
 msgid "Error message for the Captcha field"
-msgstr ""
+msgstr "Captcha フィールド用のエラーメッセージ"
 
 #: contact_form.php:919
 #: contact_form.php:948
 msgid "Error message for the whole form"
-msgstr ""
+msgstr "全体フォーム用のエラーメッセージ"
 
 #: contact_form.php:921
 #: contact_form.php:950
 #: contact_form.php:969
 #: contact_form.php:975
 msgid "Use shortcode"
-msgstr ""
+msgstr "短いコードの利用"
 
 #: contact_form.php:921
 #: contact_form.php:950
 #: contact_form.php:969
 #: contact_form.php:975
 msgid "for this language"
-msgstr ""
+msgstr "この言語用"
 
 #: contact_form.php:957
 msgid "Action after email is sent"
-msgstr ""
+msgstr "メール送信後の行動"
 
 #: contact_form.php:959
-#, fuzzy
 msgid "Display text"
-msgstr "添付ブロックを表示"
+msgstr "テキストを表示"
 
 #: contact_form.php:968
 #: contact_form.php:974
 msgid "Text"
-msgstr ""
+msgstr "文字"
 
 #: contact_form.php:981
 msgid "Redirect to the page"
-msgstr ""
+msgstr "ページに転送"
 
 #: contact_form.php:982
 msgid "Url"
-msgstr ""
+msgstr "Url"
 
 #: contact_form.php:987
 #: contact_form.php:1162
@@ -738,61 +705,56 @@ msgid "Save Changes"
 msgstr "変更を保存"
 
 #: contact_form.php:1002
-#, fuzzy
 msgid "Contact Form Pro | Extra Settings"
-msgstr "コンタクトフォーム オプション"
+msgstr "Contact Form Pro | 追加設定"
 
 #: contact_form.php:1009
 msgid "This functionality is available in the Pro version of the plugin. For more details, please follow the link"
-msgstr ""
+msgstr "この機能は、プラグインのProバージョンで利用できます。詳細は、リンクを参照して下さい。"
 
 #: contact_form.php:1016
 msgid "Errors output"
-msgstr ""
+msgstr "エラー出力"
 
 #: contact_form.php:1019
 msgid "Display error messages"
-msgstr ""
+msgstr "エラーメッセージの表示"
 
 #: contact_form.php:1020
 msgid "Color of the input field errors."
-msgstr ""
+msgstr "入力フィールド・エラーの色"
 
 #: contact_form.php:1021
 msgid "Display error messages & color of the input field errors"
-msgstr ""
+msgstr "エラーメッセージと入力フィールド・エラーの色を表示"
 
 #: contact_form.php:1026
 msgid "Add placeholder to the input blocks"
-msgstr ""
+msgstr "プレースホルダーを入力ブロックに追加"
 
 #: contact_form.php:1032
-#, fuzzy
 msgid "Add tooltips"
-msgstr "追加オプション"
+msgstr "ツールチップの追加"
 
 #: contact_form.php:1046
-#, fuzzy
 msgid "Email address"
-msgstr "E-Mail:"
+msgstr "Eメール・アドレス"
 
 #: contact_form.php:1051
 msgid "Phone Number"
-msgstr ""
+msgstr "電話番号"
 
 #: contact_form.php:1065
-#, fuzzy
 msgid "Attachment"
-msgstr "添付:"
+msgstr "添付"
 
 #: contact_form.php:1075
-#, fuzzy
 msgid "Style options"
-msgstr "追加オプション"
+msgstr "スタイル・オプション"
 
 #: contact_form.php:1078
 msgid "Text color"
-msgstr ""
+msgstr "文字色"
 
 #: contact_form.php:1081
 #: contact_form.php:1086
@@ -807,118 +769,114 @@ msgstr ""
 #: contact_form.php:1148
 #: contact_form.php:1153
 msgid "Default"
-msgstr ""
+msgstr "標準"
 
 #: contact_form.php:1083
 msgid "Label text color"
-msgstr ""
+msgstr "ラベル文字色"
 
 #: contact_form.php:1088
 msgid "Placeholder color"
-msgstr ""
+msgstr "プレースホルダ色"
 
 #: contact_form.php:1093
 msgid "Errors color"
-msgstr ""
+msgstr "エラーの色"
 
 #: contact_form.php:1098
 msgid "Error text color"
-msgstr ""
+msgstr "エラーテキストの色"
 
 #: contact_form.php:1103
 msgid "Background color of the input field errors"
-msgstr ""
+msgstr "入力フィールド・エラーの背景色"
 
 #: contact_form.php:1108
 msgid "Border color of the input field errors"
-msgstr ""
+msgstr "入力フィールド・エラーの罫線色"
 
 #: contact_form.php:1113
 msgid "Placeholder color of the input field errors"
-msgstr ""
+msgstr "入力フィールド・エラー用のプレースホルダ色"
 
 #: contact_form.php:1118
-#, fuzzy
 msgid "Input fields"
-msgstr "添付ブロックを表示"
+msgstr "フィールドを入力"
 
 #: contact_form.php:1123
 msgid "Input fields background color"
-msgstr ""
+msgstr "フィールドの背景色の入力"
 
 #: contact_form.php:1128
 msgid "Text fields color"
-msgstr ""
+msgstr "文字フィールド色"
 
 #: contact_form.php:1130
 msgid "Border width in px, numbers only"
-msgstr ""
+msgstr "罫線幅(px単位)、数値のみ"
 
 #: contact_form.php:1134
 #: contact_form.php:1155
 msgid "Border color"
-msgstr ""
+msgstr "罫線色"
 
 #: contact_form.php:1139
-#, fuzzy
 msgid "Submit button"
-msgstr "送信"
+msgstr "送信ボタン"
 
 #: contact_form.php:1141
 msgid "Width in px, numbers only"
-msgstr ""
+msgstr "px単位の幅、数字のみ"
 
 #: contact_form.php:1145
 msgid "Button color"
-msgstr ""
+msgstr "ボタンの色"
 
 #: contact_form.php:1150
 msgid "Button text color"
-msgstr ""
+msgstr "ボタン文字の色"
 
 #: contact_form.php:1166
-#, fuzzy
 msgid "Contact Form Pro | Preview"
-msgstr "Contact Form"
+msgstr "Contact Form Pro | プレビュー"
 
 #: contact_form.php:1169
 msgid "Show with errors"
-msgstr ""
+msgstr "エラーで表示"
 
 #: contact_form.php:1177
 #: contact_form.php:1179
 msgid "Please enter your full name..."
-msgstr ""
+msgstr "貴方の氏名を入力して下さい..."
 
 #: contact_form.php:1190
 #: contact_form.php:1192
 msgid "Please enter your address..."
-msgstr ""
+msgstr "貴方の住所を入力して下さい..."
 
 #: contact_form.php:1201
 #: contact_form.php:1203
-#, fuzzy
 msgid "Please enter your email address..."
-msgstr "このemailを利用:"
+msgstr "貴方のEメール・アドレスを入力して下さい..."
 
 #: contact_form.php:1212
 #: contact_form.php:1214
 msgid "Please enter your phone number..."
-msgstr ""
+msgstr "貴方の電話番号を入力して下さい..."
 
 #: contact_form.php:1223
 #: contact_form.php:1225
 msgid "Please enter subject..."
-msgstr ""
+msgstr "件名を入力して下さい..."
 
 #: contact_form.php:1233
 #: contact_form.php:1235
 msgid "Please enter your message..."
-msgstr ""
+msgstr "メッセージを入力して下さい..."
 
 #: contact_form.php:1246
 msgid "Supported file types: HTML, TXT, CSS, GIF, PNG, JPEG, JPG, TIFF, BMP, AI, EPS, PS, RTF, PDF, DOC, DOCX, XLS, ZIP, RAR, WAV, MP3, PPT. Max file size: 2MB"
-msgstr ""
+msgstr "サポートしてるファイル形式: HTML, TXT, CSS, GIF, PNG, JPEG, JPG, TIFF, BMP, AI, EPS, PS, RTF, PDF, DOC, DOCX, XLS, ZIP, RAR, WAV, MP3, PPT. 最大ファイルサイズ: 2MB"
 
 #: contact_form.php:1399
 msgid "You can attach the following file formats"
@@ -930,7 +888,7 @@ msgstr "コンタクトフォーム"
 
 #: contact_form.php:1696
 msgid "Email"
-msgstr "E-Mail"
+msgstr "Eメール"
 
 #: contact_form.php:1710
 msgid "Site"
@@ -948,9 +906,9 @@ msgstr "FAQ"
 msgid "Support"
 msgstr "サポート"
 
-#: contact_form.php:1860
+#: contact_form.php:1865
 msgid "Are you sure that you want to delete this language data?"
-msgstr ""
+msgstr "本当に、この言語データを削除しますか?"
 
 #~ msgid "Contact Form Options"
 #~ msgstr "コンタクトフォーム オプション"

programming_language: CoffeeScript
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Donate link: https://www.2checkout.com/checkout/purchase?sid=1430388&quantity=10
 Tags: Contact Form, text, contact, form, contacts, contact form, request, contact me, feedback form, feedback, contact button, contact form plugin, contacts form plugin, attachment, send, copy, attachment, send copy
 Requires at least: 2.9
 Tested up to: 3.6
-Stable tag: 3.51
+Stable tag: 3.52
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -124,6 +124,10 @@ Here is an example for the German language files.
 
 == Changelog ==
 
+= V3.52 - 13.08.2013 =
+* Update : The Japanese language file is updated.
+* Bugfix : We fixed the bug related to XSS attack.
+
 = V3.51 - 05.08.2013 =
 * Update : The Brazilian Portuguese language file is updated.
 * Update : We updated all functionality for wordpress 3.6.
@@ -358,6 +362,9 @@ Here is an example for the German language files.
 
 == Upgrade Notice ==
 
+= V3.52 =
+The Japanese language file is updated. We fixed the bug related to XSS attack.
+
 = V3.51 =
  The Brazilian Portuguese language file is updated. We updated all functionality for wordpress 3.6. We fixed the email validation bug. We removed displaying of additional info in the copy of email to the sender.
 

programming_language: Markdown