Stored Cross-Site Scripting in BuddyForms Plugin for WordPress

CVE-2024-12037

Summary

The BuddyForms plugin, commonly used for managing user submissions in WordPress, exhibits a vulnerability that allows stored cross-site scripting (XSS) attacks. This issue arises through the plugin's 'bf_new_submission_link' shortcode, which fails to sufficiently sanitize input and escape output for attributes provided by users. Authenticated attackers with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into content that will execute in the browsers of users visiting the compromised pages. This creates a significant risk for users by potentially allowing the attacker to steal session cookies, execute unauthorized actions, or redirect users to harmful websites.

References