CformsII Stored XSS Vulnerability

CVE-2024-22149

What is CVE-2024-22149?

The vulnerability presents an improper neutralization of input during web page generation, commonly known as a Cross-site Scripting (XSS) flaw. This issue allows attackers to store malicious scripts within the CformsII plugin, impacting user interactions and data integrity. Users who load a compromised page may inadvertently execute these scripts, leading to unauthorized access to sensitive information and potentially compromising entire web applications. All versions of CformsII from its inception up to 15.0.5 are affected, necessitating immediate attention to safeguard web applications utilizing this plugin.

References