MEDIUM🇬🇧 English

CVE-2024-11223

CVSS 4.7v3.1pub. 2024-12-26upd. 2025-05-08

The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

  • Wpforms

    APP
    Wpforms
    < 1.9.2.3
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
XSS
CWE
Referencje

Powiązane podatności

CVE-2024-11205HIGH8.5ten sam produkt

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit...

CVE-2023-7063HIGH7.2ten sam produkt

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission paramete...

CVE-2020-36919MEDIUM5.1ten sam produkt

WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parame...

CVE-2024-13403MEDIUM6.4ten sam produkt

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordP...

CVE-2024-56276MEDIUM4.3ten sam produkt

Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Inco...