Stored Cross-Site Scripting Vulnerability in Flo Forms Plugin for WordPress

CVE-2021-4367

What is CVE-2021-4367?

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress allows authenticated attackers, including subscribers, to exploit stored Cross-Site Scripting due to inadequate input sanitization and output escaping. By leveraging the flo_import_forms_options AJAX action, attackers can inject malicious scripts into pages that execute when users access the tainted pages, potentially compromising user data and enabling further exploitation.

References