Stored Cross-Site Scripting in WS Form LITE for WordPress
CVE-2024-13509

6.1MEDIUM

Key Information:

Vendor
WordPress
Status
Ws Form Lite – Drag & Drop Contact Form Builder For WordPress
Vendor
CVE Published:
28 January 2025

Summary

The WS Form LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input validation and output escaping, allowing attackers to inject malicious scripts through the url parameter. Unauthenticated users can exploit this vulnerability to execute arbitrary scripts in the browsers of users visiting affected pages. A partial fix was introduced in version 1.10.13, while version 1.10.14 addresses the issue fully.

Affected Version(s)

WS Form LITE – Drag & Drop Contact Form Builder for WordPress * <= 1.10.13

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3226595/ws-form
https://plugins.trac.wordpress.org/changeset/3225862/ws-form

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Coen
.