Stored Cross-Site Scripting Vulnerability in WP-FormAssembly Plugin for WordPress

CVE-2024-13501

What is CVE-2024-13501?

The WP-FormAssembly plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate sanitization of user input and insufficient escaping of output within the 'formassembly' shortcode. This allows authenticated users with contributor-level access or higher to inject malicious scripts into pages. When other users access these compromised pages, the scripts execute, potentially leading to unauthorized actions or data exposure. Users of versions 2.0.11 and prior should take immediate measures to upgrade or apply appropriate security patches.

References