Stored Cross-Site Scripting vulnerability in Formidable Forms plugin for WordPress
CVE-2023-6842
4.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 January 2024
What is CVE-2023-6842?
The Formidable Forms plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS). This vulnerability arises from inadequate input sanitization and output escaping of the name and description field labels, which can be exploited by authenticated users with administrator-level access to inject malicious scripts. While primarily affecting multi-site installations and those with unfiltered HTML disabled, this flaw can also be exploited by users with extended permissions for form management, enabling lower-level users to carry out attacks on injected pages when accessed by other users.
Affected Version(s)
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder * <= 6.7