Stored Cross-Site Scripting Vulnerability in CRM Perks Forms Plugin for WordPress
CVE-2023-2836
4.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 May 2023
What is CVE-2023-2836?
The CRM Perks Forms plugin for WordPress contains a vulnerability that allows authenticated attackers with administrator-level permissions to exploit insufficient input sanitization and output escaping in form settings. This risk is particularly relevant for multi-site installations and those with unfiltered_html disabled, where attackers can inject malicious web scripts into pages. These scripts execute when users access the compromised pages, potentially leading to unauthorized actions and data exposure.
Affected Version(s)
CRM Perks Forms – WordPress Form Builder * <= 1.1.1