Stored Cross-Site Scripting Vulnerability in Iframe Forms for WordPress

CVE-2023-5073

What is CVE-2023-5073?

The Iframe Forms plugin for WordPress is susceptible to stored cross-site scripting vulnerabilities due to insufficient input sanitization and output escaping implemented in its 'iframe' shortcode. Attackers with contributor-level access can exploit this vulnerability, allowing them to inject malicious scripts into web pages. Once these scripts are embedded, they execute whenever a user visits the affected page, potentially compromising user data and site integrity.

References