Plugin Vulnerable to Stored Cross-Site Scripting
CVE-2017-20192

8.3HIGH

Key Information:

Vendor
Strategy11team
Status
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Vendor
CVE Published:
16 October 2024

Summary

The Formidable Form Builder plugin for WordPress contains a vulnerability that permits Stored Cross-Site Scripting (XSS) attacks via multiple parameters during form submissions, including 'after_html'. This flaw arises due to inadequate input sanitization and output escaping practices in versions earlier than 2.05.03. As a result, unauthenticated attackers can exploit this weakness to inject malicious web scripts, which may execute in the browsers of affected users, leading to potential data breaches and other security risks.

Affected Version(s)

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder * < 2.05.03

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://klikki.fi/adv/formidable.html
https://wordpress.org/plugins/formidable/#developers

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jouko Pynnöne
.