Cross-site Scripting Vulnerability in Advanced Form Integration by Nasir Ahmed
CVE-2024-56293

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
Advanced Form Integration
Vendor
CVE Published:
7 January 2025

What is CVE-2024-56293?

The Advanced Form Integration plugin by Nasir Ahmed is susceptible to a stored XSS vulnerability due to improper neutralization of user input during web page generation. This allows malicious actors to inject script code into web pages visited by users, potentially compromising sensitive data and account security. This vulnerability affects all versions from before 1.95.0, emphasizing the critical need for prompt updates and security best practices.

Affected Version(s)

Advanced Form Integration 0 <= 1.95.0

References

https://patchstack.com/database/Wordpress/Plugin/advanced...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

b4orvn (Patchstack Alliance)
.