Stored Cross-Site Scripting in WS Form LITE for WordPress
CVE-2024-13509

7.2HIGH

Key Information:

Vendor

WordPress
Status
Ws Form Lite – Drag & Drop Contact Form Builder
Ws Form Pro
Vendor
CVE Published:
28 January 2025

What is CVE-2024-13509?

The WS Form LITE plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to inadequate input validation and output escaping, allowing attackers to inject malicious scripts through the url parameter. Unauthenticated users can exploit this vulnerability to execute arbitrary scripts in the browsers of users visiting affected pages. A partial fix was introduced in version 1.10.13, while version 1.10.14 addresses the issue fully.

Affected Version(s)

WS Form LITE – Drag & Drop Contact Form Builder 0 <= 1.10.13

WS Form Pro 0 <= 1.10.13

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3226595/ws-form
https://plugins.trac.wordpress.org/changeset/3225862/ws-form

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tim Coen
.