Stored Cross-Site Scripting Vulnerability in Contact Form For All WordPress Plugin
CVE-2023-5337
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 20 October 2023
What is CVE-2023-5337?
The Contact Form For All plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'formforall' shortcode due to inadequate input sanitization and output escaping on user-supplied attributes. This vulnerability enables authenticated attackers with contributor-level permissions or higher to inject malicious web scripts into pages. When a user accesses these compromised pages, the injected scripts execute, posing a significant risk to site integrity and user security.
Affected Version(s)
Contact form Form For All – Easy to use, fast, 37 languages. * <= 1.2