Stored Cross-Site Scripting Vulnerability in CRM Perks Forms Plugin for WordPress

CVE-2023-2836

Summary

The CRM Perks Forms plugin for WordPress contains a vulnerability that allows authenticated attackers with administrator-level permissions to exploit insufficient input sanitization and output escaping in form settings. This risk is particularly relevant for multi-site installations and those with unfiltered_html disabled, where attackers can inject malicious web scripts into pages. These scripts execute when users access the compromised pages, potentially leading to unauthorized actions and data exposure.

References