WordPress Tiger Forms Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-44474

7.1HIGH

Key Information:

Vendor

WordPress
Status
Tiger Forms – Drag And Drop Form Builder
Vendor
CVE Published:
2 October 2023

What is CVE-2023-44474?

The Tiger Forms plugin by MD Jakir Hosen is susceptible to an unauthenticated reflected cross-site scripting (XSS) vulnerability. This flaw exists in versions 2.0.0 and below, allowing attackers to inject malicious scripts through crafted URL parameters. If exploited, it could lead to unauthorized actions being executed in the context of a victim's browser session, potentially compromising user accounts or redirecting users to malicious sites.

Affected Version(s)

Tiger Forms – Drag and Drop Form Builder <= 2.0.0

References

https://patchstack.com/database/vulnerability/tiger-form/...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

SeungYongLee (Patchstack Alliance)
.
CVE-2023-44474 : WordPress Tiger Forms Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)