Stored Cross-Site Scripting in BuddyForms Plugin for WordPress
CVE-2024-12037
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 31 January 2025
What is CVE-2024-12037?
The BuddyForms plugin, commonly used for managing user submissions in WordPress, exhibits a vulnerability that allows stored cross-site scripting (XSS) attacks. This issue arises through the plugin's 'bf_new_submission_link' shortcode, which fails to sufficiently sanitize input and escape output for attributes provided by users. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into content that will execute in the browsers of users visiting the compromised pages. This creates a significant risk for users by potentially allowing the attacker to steal session cookies, execute unauthorized actions, or redirect users to harmful websites.
Affected Version(s)
Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) * <= 2.8.13