Plugin Vulnerable to Stored Cross-Site Scripting
CVE-2017-20192
8.3HIGH
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 16 October 2024
What is CVE-2017-20192?
The Formidable Form Builder plugin for WordPress contains a vulnerability that permits Stored Cross-Site Scripting (XSS) attacks via multiple parameters during form submissions, including 'after_html'. This flaw arises due to inadequate input sanitization and output escaping practices in versions earlier than 2.05.03. As a result, unauthenticated attackers can exploit this weakness to inject malicious web scripts, which may execute in the browsers of affected users, leading to potential data breaches and other security risks.
Affected Version(s)
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder * < 2.05.03