Stored Cross-Site Scripting in Contact Form Plugin by Fluent Forms for WordPress

CVE-2024-0618

What is CVE-2024-0618?

The Fastest Contact Form Builder Plugin for WordPress by Fluent Forms is exposed to Stored Cross-Site Scripting vulnerabilities through improperly sanitized form titles. This vulnerability affects all versions up to and including 5.1.5, allowing authenticated attackers with administrator access to inject malicious scripts. The exploited scripts can execute when users access compromised pages, primarily impacting multi-site setups or instances where unfiltered HTML is disabled.

References