Fluent Forms Quiz, Survey, and Drag & Drop WP Form Builder Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-2772

Summary

The Contact Form Plugin developed by Fluent Forms for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting (XSS). This flaw arises from inadequate input sanitization and output escaping in form settings present in all versions up to and including 5.1.13. Authenticated attackers who have access to the settings of Fluent Forms can exploit this vulnerability to inject arbitrary web scripts. These malicious scripts will execute whenever a user accesses a page that has been manipulated. Additionally, this vulnerability can be chained with another weakness, allowing even low-privileged users to inject harmful scripts into the site.

References