Stored Cross-Site Scripting in Groundhogg Plugin for WordPress

CVE-2023-2735

Summary

The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the 'gh_form' shortcode in versions up to and including 2.7.9.8. The vulnerability arises from insufficient input sanitization and output escaping for attributes provided by users. This flaw enables authenticated attackers with contributor-level permissions and higher to inject arbitrary scripts into web pages. These malicious scripts can execute when users access the compromised pages, particularly those using legacy contact forms, exposing them to potential security threats.

References